{"report_id":"66b0d750-a4dd-413b-9851-9f6b180a861b","version":6,"status":"done","tags":[],"date":"2026-02-07T00:43:37Z","url":{"schema":"http","addr":"dgt.hafiz.ba","fqdn":"dgt.hafiz.ba","domain":"hafiz.ba","tld":"ba"},"ip":{"addr":"85.13.131.247","port":0,"asn":34788,"as":"Neue Medien Muennich GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/in.php","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"title":"DGT - Multa impagada última notificación antes del recargo?","dom":{"size":39,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"086707e4369f60afedcafb16050a7618","sha1":"8216b0cc6876cbd44f01c158e7dff3833ceccd41","sha256":"a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e","sha512":"aade21843813e2cab329b99185c6f61db7907a556ea974e0315dcf3ad967cab20fee66d4f10db0d0ec43a71e086ce6d700d5524103deaefa3ce5f6be74ba5737","ssdeep":"","tlshash":"6a9000fee0a2000efc303bc00cc2238a0c28c3a830028e002ac038b8c80822bcc032c8","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"2023-03-07T01:03:24Z","last_seen":"2026-08-14T06:49:48.058869Z","times_seen":1037822,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"dgt.hafiz.ba","fqdn":"dgt.hafiz.ba","domain":"hafiz.ba","tld":"ba"},"ip":{"addr":"85.13.131.247","port":0,"asn":34788,"as":"Neue Medien Muennich GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-14T00:43:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.google.com","ip":{"addr":"142.251.38.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22,"first_seen":"2015-05-10T13:11:19Z","last_seen":"2026-02-01T22:25:59.829418Z","alert_count":0,"request_count":1,"received_data":739,"sent_data":444,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-02-01T22:14:44.580478Z","alert_count":0,"request_count":5,"received_data":205597,"sent_data":2697,"comment":"","tags":null,"fingerprints":null},{"fqdn":"translate.googleapis.com","ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":6317,"first_seen":"2012-05-31T07:21:21Z","last_seen":"2026-02-02T04:36:37.022423Z","alert_count":0,"request_count":1,"received_data":212420,"sent_data":548,"comment":"","tags":null,"fingerprints":null},{"fqdn":"dgt.hafiz.ba","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-07T00:32:37.110305Z","last_seen":"2026-02-07T00:32:37.110305Z","alert_count":0,"request_count":2,"received_data":205991,"sent_data":878,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"www.gstatic.com","ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":146047,"first_seen":"2012-05-29T15:36:17Z","last_seen":"2026-02-01T22:29:52.319656Z","alert_count":0,"request_count":2,"received_data":25736,"sent_data":1134,"comment":"","tags":null,"fingerprints":null},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-02-01T22:17:46.954894Z","alert_count":0,"request_count":1,"received_data":41331,"sent_data":475,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"erp.ed-intra.com","ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"domain_registered":"2024-08-14","domain_rank":0,"first_seen":"2026-02-06T17:16:36.080468Z","last_seen":"2026-02-06T17:16:36.080468Z","alert_count":213,"request_count":71,"received_data":821982,"sent_data":38322,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/in.php","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"08046c5aeb67c0baec4bbf591966b136","sha1":"be983a2dfd1509130d7428ee560563a6dec634da","sha256":"ec054a52f1e2977473e119fb3bd36f85ecd0d0e0177a0f0bb937fcfdae909290","sha512":"44e1d6ebc8f9d246afe13d3262d50d18774404ba72015370713c41d889f972adfc986f7541fa80ed3ba3262493935acddb5ce8ac67c207d91eb77bfba8febf2d","ssdeep":"","tlshash":"10f0abe3853101a67878838d10ca10c15300ddd2b9432736b17d12e87f4932ce25013f","size":532,"data":"","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-02-27T20:33:31.684217Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/in.php","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f370f0df791fc8bfbca10f53f624e89c","sha1":"e95cfc1ff1791d947a72ef8431ddde28ad44123b","sha256":"8593723c828a117720f71275164e30b92a977894195c30153b64a030b0bdcd6a","sha512":"e20fd4b51f51f55a7bf848ded873520001994da13369dc1cd5fe471ea763aeb4ad21b22104bfdacd9ea31ab9689784a04781a7956812e58d974f10b79e9c9fa2","ssdeep":"96:4MRiC0npYxiLZqSU/EqjsBf1/Gs7d4CIu6:45C0npYxiLZ9FB8q4Bu6","tlshash":"6291830ab694696250fe70bb337fb304b17f22123a01a4039da5dcd079e1ed79163bca","size":4211,"data":"","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-02-27T20:33:31.684953Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/in.php","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"08046c5aeb67c0baec4bbf591966b136","sha1":"be983a2dfd1509130d7428ee560563a6dec634da","sha256":"ec054a52f1e2977473e119fb3bd36f85ecd0d0e0177a0f0bb937fcfdae909290","sha512":"44e1d6ebc8f9d246afe13d3262d50d18774404ba72015370713c41d889f972adfc986f7541fa80ed3ba3262493935acddb5ce8ac67c207d91eb77bfba8febf2d","ssdeep":"","tlshash":"10f0abe3853101a67878838d10ca10c15300ddd2b9432736b17d12e87f4932ce25013f","size":532,"data":"","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-02-27T20:33:31.684217Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.fr.gon5TuJoP4M.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfpSnuRWmXyJt87XzwsB-RS4M3auAg/m=el_main","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1356965c7f64b2445b1c4e61a90067ce","sha1":"b59c7a785ef8ff561813f33bbcede4e256ba4829","sha256":"b825974573804cc825c6786b7e6af250275a9ee1fa05a9df404590f3bcca2cb4","sha512":"9ca1d2d30bd19cb3e6ab7ae6aad6325d5d91469a8225d7b47c667809a1c5959c326ebe4b5ae4190238f404f352f80da5da862303a9f4b86ea6d83f1f70da4fd1","ssdeep":"3072:SrgjuwlyetEB4sQbylcO9t8JzfCvVAF1JWQcVUieuKmr3urmDaQTlrGQm+yAw:V3tKrQbmcn1J+BLtpyQm+yAw","tlshash":"8c24e8ddb25271669263f4a6517f004eb13b685af8484d6cb68ce8e2adf0d18017bf7c","size":211559,"data":"","first_seen":"2024-06-06T21:48:48Z","last_seen":"2026-02-27T20:33:31.68331Z","times_seen":294,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/VeXUiE6MNWQQ.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/VeXUiE6MNWQQ.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/o08dZtBb9rAH.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/o08dZtBb9rAH.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: W/\"666d5a66-3622\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13858,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13858), with no line terminators","md5":"d4f53fdb14eaeb9d0c4a722cc57b896f","sha1":"15ece4bf782b4a06b8d240447e78c1ae60c64756","sha256":"2d126575b4ce7adb51d85646b5c9a4a8d1f653c235af3b5ee60bf0bf5338184d","sha512":"9b7de459a954d7a696549ddd67a6186332f2599bba35776fc5005222576a95ab35202c0443466baf0bc1cad9ba96914f6b271af7c2b7c0ec653172dbe1eb539a","ssdeep":"384:Yv+clL5DJNLoCiBBXaOtCJ2jvb2xLt6s28Hbi2OUh9:eT","tlshash":"0052ce617393b109320aedf4550c55786a347110d96e8abdbca9e7db1f01ccbe2dacb2","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-02-27T20:33:31.675173Z","times_seen":102,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/NEqXogRZUSeX.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/NEqXogRZUSeX.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/iuu48Z82d6My.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/iuu48Z82d6My.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/NRAYE-Q85HG-KF6H3-BK4GU-GHPXD","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/NRAYE-Q85HG-KF6H3-BK4GU-GHPXD HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/tFc8qip7Bbmo.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.495Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/tFc8qip7Bbmo.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.com/images/cleardot.gif","fqdn":"www.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"142.251.38.100","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:38:41 GMT","end":"Mon, 06 Apr 2026 08:38:40 GMT"},"fingerprint":{"sha1":"36:C1:99:7C:DE:5D:41:A3:C4:03:9C:34:84:BC:7A:51:36:08:1D:43","sha256":"15:C4:72:8A:29:9D:89:4F:B0:8F:6F:87:45:A5:5C:44:C9:94:5E:82:6D:DD:CF:36:8C:92:73:20:B5:3C:8A:83"}}},"request":{"raw":"GET /images/cleardot.gif HTTP/1.1\r\nHost: www.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-type: image/gif\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 43\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\nlast-modified: Tue, 22 Oct 2019 18:30:00 GMT\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":43,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"fc94fb0c3ed8a8f909dbc7630a0987ff","sha1":"56d45f8a17f5078a20af9962c992ca4678450765","sha256":"2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363","sha512":"c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e","ssdeep":"","tlshash":"cb900003cac8c022c2a2c0300a0c03002bbaa8300228030ec0bc30fcec2a3a38c02000","first_seen":"2023-04-05T02:54:04Z","last_seen":"2026-08-14T05:15:34.910688Z","times_seen":83301,"resource_available":true,"data":null}},"time_used":255,"timings":{"blocked":93,"dns":37,"connect":21,"send":0,"wait":30,"receive":0,"ssl":69},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/2AFpnm28kZAW.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/2AFpnm28kZAW.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":388,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":388,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/WHGYP46xJ8CF.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/WHGYP46xJ8CF.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/in.php","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-07T00:43:14.529Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/in.php HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:14 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 24875\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk; path=/\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PHP/8.3.30, PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":205724,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (16625)","md5":"544f2e2a69c6d8421609dacfba028a6f","sha1":"96a46d92f3731b266b62b2385a79fe8689c1adfd","sha256":"236d1eb763718f614656334d18fa23f166b12851d6d5744f58ce3e838d12f83e","sha512":"4735fdf66e1629652ca51bab5221114b44ce72c7dd88fda68a7af007b3a9fac4fa635fe89025f6eb64a67c37f07b134a53f04156e334bef478164b1f920e0713","ssdeep":"1536:HASvyf77mdhYQYQXWfNPPGYuGNo4bPo76m:HASXVq0Gpo7/","tlshash":"c1145122d8e4113f1287e1c57ab437266c93004bf249e9a777be065dbfe9f81095b60e","first_seen":"2025-11-14T16:25:29.564644Z","last_seen":"2026-02-16T15:53:23.621713Z","times_seen":10,"resource_available":false,"data":null}},"time_used":782,"timings":{"blocked":237,"dns":1,"connect":114,"send":0,"wait":193,"receive":115,"ssl":119},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/ceUx0BAguSW2.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/ceUx0BAguSW2.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Wn36N2fXvTyH.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.361Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Wn36N2fXvTyH.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Xz9Y1QP7w1HA.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Xz9Y1QP7w1HA.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://erp.ed-intra.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 13:16:47 GMT\r\nexpires: Sat, 06 Feb 2027 13:16:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 41191\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-08-14T06:54:04.63935Z","times_seen":327855,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":50,"dns":1,"connect":11,"send":0,"wait":24,"receive":3,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/jSC16PttOkDZ.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/jSC16PttOkDZ.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/css\r\ncontent-length: 214\r\nx-accel-version: 0.01\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"13b-61aea189ee580-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":315,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (314)","md5":"2904496643d6ad5935a8d7edafef22d2","sha1":"a89320d1e5f6e7550939006fed8e797c969daa36","sha256":"c7103b3919e75b8e50aa60bff722a28c6d8e13c76883b29f83c46a19f02b47c6","sha512":"e7d33b2e81d47cca777dc0696003358afa58d869b195d32888a70d347418a0132003a7dffd5f489637fb211d1372151b48f5555ff718f78a2552b36bc41b6b0f","ssdeep":"","tlshash":"03e0269362456106e502df728a49fcac646207a9d89ec838fd4086970b94a6d0a28c6e","first_seen":"2023-05-09T09:39:46Z","last_seen":"2026-08-13T15:55:30.244641Z","times_seen":123,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/WHGYP46xJ8CF.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/WHGYP46xJ8CF.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":389,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":389,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.fr.gon5TuJoP4M.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfpSnuRWmXyJt87XzwsB-RS4M3auAg/m=el_main","fqdn":"translate.googleapis.com","domain":"translate.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /_/translate_http/_/js/k=translate_http.tr.fr.gon5TuJoP4M.O/am=ABA/d=1/exm=el_conf/ed=1/rs=AN8SPfpSnuRWmXyJt87XzwsB-RS4M3auAg/m=el_main HTTP/1.1\r\nHost: translate.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 72804\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 17:16:13 GMT\r\nexpires: Sat, 06 Feb 2027 17:16:13 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Wed, 05 Jun 2024 17:13:22 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 26822\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":211559,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2286)","md5":"1356965c7f64b2445b1c4e61a90067ce","sha1":"b59c7a785ef8ff561813f33bbcede4e256ba4829","sha256":"b825974573804cc825c6786b7e6af250275a9ee1fa05a9df404590f3bcca2cb4","sha512":"9ca1d2d30bd19cb3e6ab7ae6aad6325d5d91469a8225d7b47c667809a1c5959c326ebe4b5ae4190238f404f352f80da5da862303a9f4b86ea6d83f1f70da4fd1","ssdeep":"3072:SrgjuwlyetEB4sQbylcO9t8JzfCvVAF1JWQcVUieuKmr3urmDaQTlrGQm+yAw:V3tKrQbmcn1J+BLtpyQm+yAw","tlshash":"8c24e8ddb25271669263f4a6517f004eb13b685af8484d6cb68ce8e2adf0d18017bf7c","first_seen":"2024-06-06T21:48:48Z","last_seen":"2026-02-27T20:33:31.68331Z","times_seen":294,"resource_available":true,"data":null}},"time_used":297,"timings":{"blocked":119,"dns":54,"connect":14,"send":0,"wait":8,"receive":15,"ssl":85},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Klr7hvuKHdee.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Klr7hvuKHdee.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/CoLGU3WhGnyk.svg","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.157Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/CoLGU3WhGnyk.svg HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 703\r\nx-accel-version: 0.01\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"2bf-61aea189ee580\"\r\naccept-ranges: bytes\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":703,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9f88379b89d458d916f95a65c0f07034","sha1":"32f8e8046b5db4e2d671278e21122703a9ff1353","sha256":"624774879a4047a03df7de87a6507d605052225cebff2cfc078ed2fca3675590","sha512":"51fbdaf1f4c9996ea619fefcf56a2870efcc073ef34ca8ac80af70740d71131742243ae537410b80a306d009625af8bdf75a83d8584c4a5b17af26275f782d08","ssdeep":"","tlshash":"ee017b7835bd0c1c68060a21d7ea76b44c2cd453862504a1f66c24ba2fb095dcadfada","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-02-27T20:33:31.672469Z","times_seen":87,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/lyIEVW9yYPjj.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/lyIEVW9yYPjj.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":414,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":414,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/cookify.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.672Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/cookify.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://erp.ed-intra.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 13:16:47 GMT\r\nexpires: Sat, 06 Feb 2027 13:16:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 41191\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-08-14T06:54:04.63935Z","times_seen":327855,"resource_available":false,"data":null}},"time_used":184,"timings":{"blocked":85,"dns":1,"connect":26,"send":0,"wait":8,"receive":4,"ssl":52},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/qQzn3mrXA8vg.png","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.691Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/qQzn3mrXA8vg.png HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 562\r\nx-accel-version: 0.01\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"232-61aea189ee580\"\r\naccept-ranges: bytes\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":562,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 64 x 65, 8-bit colormap, non-interlaced","md5":"b2e39af3aa643693cbc0c23c505f06ab","sha1":"1b0b4e2a2aed0dda8fce6992f22ef22f9ecbac7b","sha256":"1a5bc51248108a6f874508a6b09d5713ba9429baf6bbb14089c642b50ac05c1a","sha512":"d515886d4ae9d3bac8ac37ed56cfc7dd97c81817828897250e1d9c0950c29613d0304acc98b75315860ab9ab4dcc9040d23c10c8a09108353928dcebf0f5edbd","ssdeep":"","tlshash":"1ef00ec63200af5ed8fdc160862be053db8bc0b5d49d0e0b40a1ae440787b65646427a","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-06-21T06:15:00.91394Z","times_seen":164,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"dgt.hafiz.ba/","fqdn":"dgt.hafiz.ba","domain":"hafiz.ba","tld":"ba"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-07T00:43:14.284Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: dgt.hafiz.ba\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T06:51:58.728112Z","times_seen":17882292,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":103,"connect":22,"send":0,"wait":0,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/ShpM4vD8irs5.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/ShpM4vD8irs5.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":271,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/cookiealert.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/cookiealert.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Wn36N2fXvTyH.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Wn36N2fXvTyH.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":422,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":422,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Jh8g3BcHtVzo.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.206Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Jh8g3BcHtVzo.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Klr7hvuKHdee.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Klr7hvuKHdee.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":386,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":386,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/iuu48Z82d6My.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/iuu48Z82d6My.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":417,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":417,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=AAM/d=0/rs=AN8SPfrUh4eQMB1I5qTj-4-oeXAO15kIQQ/m=el_main_css","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.228Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=AAM/d=0/rs=AN8SPfrUh4eQMB1I5qTj-4-oeXAO15kIQQ/m=el_main_css HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"rosetta\"\r\nreport-to: {\"group\":\"rosetta\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/rosetta\"}]}\r\ncontent-length: 4144\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 17:16:13 GMT\r\nexpires: Sat, 06 Feb 2027 17:16:13 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 04 Apr 2024 07:26:25 GMT\r\ncontent-type: text/css; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 26822\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22367,"size_decoded":0,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (22367), with no line terminators","md5":"b0b46b807eee39af0aad8f5fefc9b3a2","sha1":"0fb04f15599bc0844063a6ab776c86e73cb9fbfc","sha256":"71ca2652e2b3ffd3c0ec966958604714ce6c7af01d961b44adc438518eb58cb3","sha512":"4eec49904a5480940124a1c1b9c9dae764ebb115829cbce4356e66a1d7f077dfd204a4634b0622ffb14cc6ebff7062d7f30502bf0bc7d998a1a55fc8c876da8e","ssdeep":"384:gM78SUevMTjuFzouWaqWAlpTpdHjPtcnG:p7oevMX5HjPwG","tlshash":"78a2bb21479ed01963afe85354d36dff72d488db50113eeaaf5a3352cd822f231ea215","first_seen":"2023-08-05T13:27:36Z","last_seen":"2026-08-13T11:34:15.939279Z","times_seen":1502,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":125,"dns":0,"connect":20,"send":0,"wait":21,"receive":0,"ssl":138},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"dgt.hafiz.ba/","fqdn":"dgt.hafiz.ba","domain":"hafiz.ba","tld":"ba"},"ip":{"addr":"85.13.131.247","port":80,"asn":34788,"as":"Neue Medien Muennich GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-07T00:43:14.481Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: dgt.hafiz.ba\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Sat, 07 Feb 2026 00:43:14 GMT\r\nServer: Apache\r\nLocation: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nContent-Length: 293\r\nKeep-Alive: timeout=2, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":205724,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T06:51:58.728112Z","times_seen":17882292,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":21,"dns":1,"connect":22,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/YiKPiJLpDKou.png","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/YiKPiJLpDKou.png HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: image/png\r\ncontent-length: 13741\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-35ad\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13741,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 267 x 183, 8-bit/color RGB, non-interlaced","md5":"6c6f7346d3946f6fbf94f1a2bf60457e","sha1":"a563dd0fa4e3467d289c8604f56917ff2dca1862","sha256":"45f2cd15044dad0167c25429e9bb4aee60b2531a777b9a28653f58534ad5710f","sha512":"cc06adddad73ee2e804ad016c9d463e26fb3e7dd4ee992481fe336a4da698d88560c538e0161b418be99b7c7ac4c89a0d16baa484fd7f5119bf859ffd51d78ce","ssdeep":"192:bM46G/8Q9NVmtqHLm1E//448eFqBwQRmD0CbC2qGxpvVgJNuzD7M7yU9RyxAp0:bM4b36vK4H7WQAGvUVg67MzRy7","tlshash":"9f52c0e68dcc7bef1c2a1c5825b45be5c84add8853c7b21e2891d07ae46e3c715a78c2","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-06-21T06:15:00.926525Z","times_seen":161,"resource_available":false,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":389,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,600i,700,700i","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.251.38.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:56 GMT","end":"Mon, 06 Apr 2026 08:37:55 GMT"},"fingerprint":{"sha1":"DE:3B:B4:94:98:33:3A:CB:2A:A9:96:A1:CB:19:8C:84:B5:8D:23:E9","sha256":"D0:A1:5A:83:80:77:19:74:AA:CB:27:69:4A:C7:2C:F0:DA:06:9C:79:1E:07:77:9A:4D:7B:5D:AA:A2:D2:D4:E9"}}},"request":{"raw":"GET /css?family=Open+Sans:300,400,400i,600,600i,700,700i HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 07 Feb 2026 00:43:15 GMT\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40645,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"e3962154f84228633357e8791a009d4f","sha1":"afcf21462e97446c43e96dbd7d3d60a6a55b0f85","sha256":"4ab35fe7b761a543d6091974fc6238c2ef47b42da43a8c993ea6ec54c6a918e1","sha512":"165a4c5a43b78f881a3aed65d362be5e4a58cb775961c53902e0c4a73673da116406024383cc31fd1686e8f2e5532c599d43847ae0c07e25f1d324c5b7156b65","ssdeep":"384:+bOjI8t7KvGqY49xn+vROFuGttcvoqY497nMZ6OiFLty5v7qY49Un1mAYqY4tjXv:kiCAgkgHLFosL3Jbc2","tlshash":"50032d910417245066432de233de3e30ee0fa2617044d076abfd9b9beedad6963b435d","first_seen":"2025-09-18T16:43:48.213371Z","last_seen":"2026-08-12T19:56:36.978491Z","times_seen":334,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":53,"dns":0,"connect":20,"send":0,"wait":31,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/6qDf7JNIEpf.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.668Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/6qDf7JNIEpf.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/MBfIHls3J02X.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/MBfIHls3J02X.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/ceUx0BAguSW2.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.756Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/ceUx0BAguSW2.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/2fWrOqSOYOOw.svg","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.160Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/2fWrOqSOYOOw.svg HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1607\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-647\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1607,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1b581806ac1abab99411223fa131cb42","sha1":"7781e405c4c4c5da4da13c700f3df87797a38680","sha256":"200a1f9ae732cc1cf2fd1b5fa1ff3f6defaa0c18f915cef872ca9da2ec3db0fd","sha512":"58c0f712f2c4d3cf54149a92e3119bb9415fb376caa920ee0aca13865710591b4f04b3e9945ac1cb7280312c5af6c373a1142867815ce2f72635ba7d23f4cd02","ssdeep":"","tlshash":"ac312ebf0251c32eaad1c74c8eb0b0667566f1db7192b0c89fe396a79c060f34174810","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-02-27T20:33:31.662479Z","times_seen":86,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/cookify.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.191Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/cookify.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/gpNPMzWhv2DG.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/gpNPMzWhv2DG.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Xz9Y1QP7w1HA.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Xz9Y1QP7w1HA.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":407,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":407,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/ZGxjMFHKg0TP.svg","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/ZGxjMFHKg0TP.svg HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 19098\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-4a9a\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":19098,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e8f7d5a880999bf2c6d277c89bdbe89","sha1":"6d20cc9744dd88da50b795805a76b9382d01357e","sha256":"1d55cf624c43130cc018186a0c7be61e7dacfd50064bcc34824339de7cca13b7","sha512":"d4b6b3d06eaed479f8fe09c48849a7a774dd71eff849ecaeffa1bea08473ee94c5b5e82653c5ddb9b0d18e0350bf29157d9ca97ab3c6a64180f173a18c29e1ea","ssdeep":"384:svX2afgcgn+Gm/RGC5noFPdBeMMvnfjx4Ru:suxTmQC5Yy4c","tlshash":"7682b511877545b4f0ad46e0c8a308423e0a18e733967e55fe5dbb30ffb1de0126eaa6","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-05-14T16:04:42.281146Z","times_seen":129,"resource_available":false,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":65,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/S570ri9xbZuY.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.822Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/S570ri9xbZuY.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/css\r\ncontent-length: 375\r\nx-accel-version: 0.01\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"2f6-61aea189ee580-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":758,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (758), with no line terminators","md5":"61d2f77a3295e1318f088005bff63e70","sha1":"35d2cdf67b0bdce3a627c6dd788460ae5dc20147","sha256":"e3876ae7384412be4c830d763203a48e061028eb152f9f28ddbddd6ee4fe060f","sha512":"bf93d1a0eedb8f3ef5e856716b561de6f646189e7de0a3472585b53f0819ab163827739cd92601e5f79ce0c157808dc29385792dfe62bd1dda494e1d09c64274","ssdeep":"","tlshash":"7f01f9b2f68431d43a12c02db051febe9d3e0170c64f1bb56c4663a8d6191a747d4dae","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-07-30T00:55:39.449902Z","times_seen":144,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/mEsnNuQMdAjd.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/mEsnNuQMdAjd.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/BLU5DaOBqGXC.svg","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/BLU5DaOBqGXC.svg HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1303\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-517\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":1303,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6e43868b43c8e4bd43cf1ec7383fd13c","sha1":"e636b3868bd757bdd5e25f3e3a9237c1f41572d7","sha256":"deb1da9475dac369af5c69f4fe0867f86297232b8dc658cd78f54795440257dd","sha512":"79c07a820151d8e5c8eddb4077304132ab5b1b38603844038ca557954f59714c97088c9ffa2010245e027c9ecf5d67aaae5bcb493188dc1971b81758ffd31b95","ssdeep":"","tlshash":"09210f7b02106f758a01c35c170c7225311982a6f1bbf0cc4b4f74a6cd055eb9878c52","first_seen":"2024-07-01T22:49:36Z","last_seen":"2026-02-27T20:33:31.673321Z","times_seen":86,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/opensans/v44/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://erp.ed-intra.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 50216\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 04 Feb 2026 21:35:42 GMT\r\nexpires: Thu, 04 Feb 2027 21:35:42 GMT\r\ncache-control: public, max-age=31536000\r\nage: 184056\r\nlast-modified: Mon, 15 Sep 2025 16:31:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":50216,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 50216, version 1.0","md5":"b577bb8d8c25082a9a50522f5ec995e5","sha1":"b3e5bd7b3c40d97eeefad7837daa986857596070","sha256":"186836b74ceac07b2764c07c0379420e3014efb30fe918461c235e0ef6cbc4a2","sha512":"54d26a07921bc6ea7c90b3d810c3e1e965e6dbc227b002cc385c07d2f3878ec42c7580663b8663638d7cad3ff50a8402dd64673aec5452d26d30760fb5c871c9","ssdeep":"1536:fTniLxNYt7dypMNb88NcWU5a91c+D+ZXA:Ti1NYtRyp2g8iW4atkXA","tlshash":"4a33f10bc7bbaa5ec58c1bb5cd55d311a980b0f1c028bf2724230b8537a899c62b65f9","first_seen":"2025-09-17T00:16:45.72892Z","last_seen":"2026-08-14T04:53:54.149563Z","times_seen":54810,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":57,"dns":1,"connect":20,"send":0,"wait":22,"receive":6,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/JaATRUQJA6FH.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/JaATRUQJA6FH.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/6qDf7JNIEpf.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/6qDf7JNIEpf.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":266,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/LKNLKlqn6Zsz.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/LKNLKlqn6Zsz.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":405,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":405,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/psHgvnZNJDD8.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/psHgvnZNJDD8.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/i/productlogos/translate/v14/24px.svg","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/i/productlogos/translate/v14/24px.svg HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ncontent-length: 3340\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 13:19:22 GMT\r\nexpires: Sat, 06 Feb 2027 13:19:22 GMT\r\ncache-control: public, max-age=31536000\r\nage: 41036\r\nlast-modified: Wed, 20 Apr 2022 14:24:23 GMT\r\ncontent-type: image/svg+xml\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6225,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2bd5c073a88b83ed74db88282a56ddfb","sha1":"d0ebfc376f8c6a44a8d4cd216817dcd7d0c33650","sha256":"ab5c23a05e39deed14d9d8262b0dce9f024f86105a27196cad37d14a3f516e09","sha512":"5c6c4a92e93fc0f6a675658cc84f6187fdebd3eee94efd07e24658736cba598f3bc7156b19834b13fb44c1d43fcb7df9fcca7f0a453037e30da76ba8f4b23b89","ssdeep":"96:+R2K3Z4n7tyVwip82hezk6227gLFoXhu1XuE20ot+pVY3YptWDzOzgXK3Zx:ql3KnxyGGMzb7noR20NTww33","tlshash":"c1d1e6f19309d815cd6a83d8cd9b8002aa1f25ddd50ac6cc7639fb3bd1a50eb1d2d7a4","first_seen":"2023-04-06T21:34:37Z","last_seen":"2026-08-14T05:15:34.904409Z","times_seen":79825,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/MBfIHls3J02X.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.195Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/MBfIHls3J02X.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/zJXYEk97DNZK.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/zJXYEk97DNZK.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/NRAYE-Q85HG-KF6H3-BK4GU-GHPXD","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/NRAYE-Q85HG-KF6H3-BK4GU-GHPXD HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":400,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/psHgvnZNJDD8.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/psHgvnZNJDD8.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/media/Vg6TO6dgX4go.mp3","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/media/Vg6TO6dgX4go.mp3 HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: \"328-61fa7e905c5a0\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":120,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/error_docs/styles.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/index_files/saved_resource.html","date":"2026-02-07T00:43:18.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /error_docs/styles.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/index_files/saved_resource.html\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/css\r\ncontent-length: 950\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: \"aa0-61fa7e905c5a0-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":2720,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"37bad995c7d2b944ed19b2f70bee94ee","sha1":"96558654b0b86c6094e8e56d9803fe7fe422be1d","sha256":"6b93df5613a6b28fa3aaa6a34a9d05cdfe7382fd09f52c38b3a29a936edb786c","sha512":"8bb9df9348de1de16cd805482b1cb2639b0beca280a9c4f33808a1a38cbc2bbfaaa7ce4938fde22e2c3028fd0e230cfb48bfa84c13e72dfa8f923284a51ed65e","ssdeep":"","tlshash":"5651f66b976716856817887437ea4b44337c8017980aeebc7edfba14cf461509cd27cd","first_seen":"2024-02-22T10:21:54Z","last_seen":"2026-08-10T03:59:32.925709Z","times_seen":825,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/rAPSEzQPNP3q.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/rAPSEzQPNP3q.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/l7y2zMadsOmu.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/l7y2zMadsOmu.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: W/\"666d5a66-f59\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":3929,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (3928)","md5":"da7262fc183e15ecaceee9f0efaa4655","sha1":"01d268b30d22254c4cd6c583e91feea15b6b78af","sha256":"2ec1d2032daf47da420abf0f0e67ab2654648aabdda55e89e6da392b6158c382","sha512":"51a25a4d9f63126c42fec94332d526496131695b0e01f6c39c1aaedf626701fdb5fa5eafecfaf9c0f0d132fedb82d4cafa7d8ba0fb1a72ec5d2d643f6ec77e98","ssdeep":"","tlshash":"3c811d807757715c717aea41f9a8651cf1202227949e8e3cf649e3384be3c89e6d3ed8","first_seen":"2023-05-08T17:31:49Z","last_seen":"2026-08-13T15:55:30.233728Z","times_seen":676,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/khRuEzYsigPU.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/khRuEzYsigPU.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/Jh8g3BcHtVzo.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.490Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/Jh8g3BcHtVzo.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":123,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/NEqXogRZUSeX.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/NEqXogRZUSeX.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/khRuEzYsigPU.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.394Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/khRuEzYsigPU.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/VeXUiE6MNWQQ.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/VeXUiE6MNWQQ.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/2AFpnm28kZAW.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/2AFpnm28kZAW.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/zJXYEk97DNZK.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:16.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/zJXYEk97DNZK.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:16 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/LKNLKlqn6Zsz.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/LKNLKlqn6Zsz.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/images/branding/product/2x/translate_24dp.png","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.19.227","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /images/branding/product/2x/translate_24dp.png HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.gstatic.com/_/translate_http/_/ss/k=translate_http.tr.26tY-h6gH9w.L.W.O/am=AAM/d=0/rs=AN8SPfrUh4eQMB1I5qTj-4-oeXAO15kIQQ/m=el_main_css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy-report-only: same-origin; report-to=\"static-on-bigtable\"\r\nreport-to: {\"group\":\"static-on-bigtable\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/static-on-bigtable\"}]}\r\ncontent-length: 1842\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 22:12:39 GMT\r\nexpires: Sat, 06 Feb 2027 22:12:39 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 14 Oct 2021 09:08:00 GMT\r\ncontent-type: image/png\r\nvary: Origin\r\nage: 9039\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1842,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"c69c796362406f9e11c7f4bf5bb628da","sha1":"e489ce95ab56208090868882113d7416abf46775","sha256":"4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82","sha512":"d3ad560ed0fd29be7d2cc434694f09e5a6fbea8b29c0611aecb54a1b73b4d722c53f42a19dae9e3d5d358444e50fb8fffbc39d67ce751bdbc8c861f6f95d3162","ssdeep":"","tlshash":"4e31f9fd129220437101ade72165eef798347c15f412da60ce65ba389c9fe20ed9a619","first_seen":"2023-04-05T07:39:29Z","last_seen":"2026-08-14T05:15:34.943137Z","times_seen":74827,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/yS5TgpTNHslm.png","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/yS5TgpTNHslm.png HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: image/png\r\ncontent-length: 4832\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-12e0\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":4832,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 768 x 769, 8-bit colormap, non-interlaced","md5":"07f3c03e41fc38eb3fe2bcced553a3a9","sha1":"8dfa71b0f98005abbff9fc4838c21d752be0e07e","sha256":"46606314c5ed49573ddbb137e8ea52d5bd1e6641d422efbdffb54073b5020d88","sha512":"86984b9f72af888935a315fb25dbb573c178869ab4822a5f2ec471c9be8d0a779893ab1339232db4217ef60f1a12161e30400895b3885fbd6272d76e9cdbe4b1","ssdeep":"96:eaaaaaaaaaaaZ82V1XFYuWv0OyQSN/UrLLV9P5niSahsejayKpRnyV1:vkhv0nQs2ejayKpxQ","tlshash":"40a15ce27d812dfdc2f8d8b9218be24067fb2651cd09654d10a45e27a03dbe279dd828","first_seen":"2024-06-30T22:36:37Z","last_seen":"2026-06-21T06:15:00.919142Z","times_seen":166,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/ZWcimEQWKYS1.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/ZWcimEQWKYS1.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/css/uvzM0MXxdviy.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: W/\"666d5a66-74892\"\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":477330,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0067161cc0f900cb138b6431d9aa3845","sha1":"5550927672f121747f95f72e293416cc9ce70166","sha256":"ba516936c5cee71dd57142f831eb9dcc7580eb6eb484698b0448ba394c043b0a","sha512":"f49f5293323e1eb26ecc74deda3164965ca59eb1bb01f13e491ede9d865ea202c2182b1e145395264da8ecb24d59c03c87adf8dab892fde9a9f0573c873f8f16","ssdeep":"12288:a/0jUeU1ulKJJ7ochVShU+m9FkycOZgs4qPMMb:0","tlshash":"d1a4a799bef11804705b95a864aa77d53b2d4042da0dcebeb6e2351cdf8c3d458b3b8c","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-02-27T20:33:31.676075Z","times_seen":78,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":280,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/mEsnNuQMdAjd.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/mEsnNuQMdAjd.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/tFc8qip7Bbmo.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/tFc8qip7Bbmo.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":387,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":387,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/cookiealert.css","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/cookiealert.css HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/fonts/dDXXHQSd4jI6.woff2","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/fonts/dDXXHQSd4jI6.woff2 HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\ncontent-length: 808\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: \"328-61fa7e905c5a0\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/lyIEVW9yYPjj.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/lyIEVW9yYPjj.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/gpNPMzWhv2DG.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:17.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/gpNPMzWhv2DG.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:17 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":122,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/saved_resource.html","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.075Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/saved_resource.html HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/index_files/JaATRUQJA6FH.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/index_files/JaATRUQJA6FH.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/js/ZWcimEQWKYS1.js.t%C3%A9l%C3%A9chargement","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:15.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/js/ZWcimEQWKYS1.js.t%C3%A9l%C3%A9chargement HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/in.php\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:15 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":121,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/fonts/dgt-font.woff2","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/fonts/dgt-font.woff2 HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 13876\r\nlast-modified: Sat, 15 Jun 2024 09:09:58 GMT\r\netag: \"666d5a66-3634\"\r\nx-powered-by: PleskLin\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13876,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 13876, version 1.0","md5":"031620000d7b24090c5b7af0ea6902eb","sha1":"2064f5f9ba700d64f92f929453f3d8b46fae0590","sha256":"4d3d8e6791a6a2c23e7184093f42907c5de0ef23b1eeb89eac12c88677bbe726","sha512":"ffd779f46a2a4266cf3c5a5c14d831915c2285f57bc9716df297b7f671a22780111d99503beb31299c10baf0ecf2bc260e2d8107d4ce73fde7a0468b406c7f63","ssdeep":"192:A+XZziaK2lgMgTIr6zgFRoVmxrbCmf4//D5Qz0Bwk9yijfzgtonHknApEnb4YvOr:DislS5Zwxu//tS0yhGBnHahnb4oZm","tlshash":"1252c0ab3f29061ea99189fbf059ba335dc2957d88010f3ddb0590e6f5c45e029df8b4","first_seen":"2024-06-30T22:36:36Z","last_seen":"2026-04-20T17:38:41.531431Z","times_seen":133,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":122,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"erp.ed-intra.com/Login/css/dgt/assets/images/CrFfU002mZ1x.svg","fqdn":"erp.ed-intra.com","domain":"ed-intra.com","tld":"com"},"ip":{"addr":"74.208.237.139","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.165Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"erp.ed-intra.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 22 Dec 2025 21:33:38 GMT","end":"Sun, 22 Mar 2026 21:33:37 GMT"},"fingerprint":{"sha1":"1D:A0:B7:9D:E9:77:5F:98:2A:BF:7E:D0:12:BF:5A:64:01:71:6F:15","sha256":"07:83:C7:5F:67:84:E5:F5:97:EE:65:59:C7:D4:AC:63:F7:2C:6B:F0:E8:E3:78:BD:79:6A:00:EB:06:B6:83:88"}}},"request":{"raw":"GET /Login/css/dgt/assets/images/CrFfU002mZ1x.svg HTTP/1.1\r\nHost: erp.ed-intra.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://erp.ed-intra.com/Login/css/dgt/assets/css/uvzM0MXxdviy.css\r\nCookie: PHPSESSID=9kaa5bbbdrdqg2f4hstkguhjuk\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 07 Feb 2026 00:43:18 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 14 Aug 2024 17:18:09 GMT\r\netag: W/\"328-61fa7e905c5a0\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":808,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-08-14T06:42:43.066275Z","times_seen":38817,"resource_available":true,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":124,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-06","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-06","alert":"Phishing Block","trigger":"erp.ed-intra.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-07","alert":"Sinkholed","trigger":"erp.ed-intra.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.3","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://erp.ed-intra.com/Login/css/dgt/in.php","date":"2026-02-07T00:43:18.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 12 Jan 2026 08:37:55 GMT","end":"Mon, 06 Apr 2026 08:37:54 GMT"},"fingerprint":{"sha1":"C9:11:F3:8A:1F:95:BA:78:F0:71:09:AC:AA:E5:AC:D1:ED:83:E4:04","sha256":"61:45:36:53:9C:8E:E6:E3:72:93:D5:B6:2E:25:31:08:2F:70:5B:C8:FA:43:EA:70:B8:CE:11:BF:74:C7:92:98"}}},"request":{"raw":"GET /s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://erp.ed-intra.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48320\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 06 Feb 2026 13:16:47 GMT\r\nexpires: Sat, 06 Feb 2027 13:16:47 GMT\r\ncache-control: public, max-age=31536000\r\nage: 41191\r\nlast-modified: Mon, 15 Sep 2025 16:30:41 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48320,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48320, version 1.0","md5":"dcf31ebe107435bd68e0164d59e19b87","sha1":"b68160c9333af833fe483928b3ef7128c07a56a0","sha256":"d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0","sha512":"130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08","ssdeep":"768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE","tlshash":"1623f218f29471f7edecd4d500a18c72baa528d442f116ed07b8d53ca36ca817a729fb","first_seen":"2025-09-17T00:07:53.723302Z","last_seen":"2026-08-14T06:54:04.63935Z","times_seen":327855,"resource_available":false,"data":null}},"time_used":143,"timings":{"blocked":59,"dns":1,"connect":19,"send":0,"wait":8,"receive":15,"ssl":38},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}