{"report_id":"731694b2-200c-4d5b-b9c0-801f8bb13c03","version":6,"status":"done","tags":["meta","facebook","phishing","social","suspicious","telegram_bot"],"date":"2025-10-16T19:52:29Z","url":{"schema":"https","addr":"www.casefb918276-2ubg.vercel.app/","fqdn":"www.casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"title":"Meta for Business - Page Appeal"},"submit":{"url":{"schema":"https","addr":"www.casefb918276-2ubg.vercel.app/","fqdn":"www.casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.195","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-20T19:52:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":3,"analyzer":9}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-16T19:52:08Z","timestamp":1760644328,"ip_dst":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":34694,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)","source":"{\"timestamp\":\"2025-10-16T19:52:08.368071+0000\",\"flow_id\":339084663335071,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":34694,\"dest_ip\":\"34.117.59.81\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2025331,\"rev\":5,\"signature\":\"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Linux\",\"Mac_OSX\",\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2018_02_07\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2024_09_19\"]}},\"tls\":{\"sni\":\"ipinfo.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":911,\"bytes_toclient\":1606,\"start\":\"2025-10-16T19:52:08.338079+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-10-16","alert":"Detects file containing Telegram Bot API","trigger":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"casefb918276-2ubg.vercel.app","ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-10-16T19:52:30.554671Z","last_seen":"2025-10-16T19:52:30.554671Z","alert_count":97,"request_count":19,"received_data":1532598,"sent_data":11599,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}]},{"fqdn":"ipinfo.io","ip":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2013-04-23","domain_rank":1327,"first_seen":"2013-12-16T07:25:53Z","last_seen":"2025-10-13T00:22:48.323125Z","alert_count":0,"request_count":1,"received_data":650,"sent_data":457,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.74.168","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2025-10-12T22:12:10.358486Z","alert_count":0,"request_count":1,"received_data":427352,"sent_data":449,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.casefb918276-2ubg.vercel.app","ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-10-16T19:52:30.550209Z","last_seen":"2025-10-16T19:52:30.55021Z","alert_count":8,"request_count":2,"received_data":2175,"sent_data":1002,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.74.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2025-10-12T22:17:47.775352Z","alert_count":0,"request_count":1,"received_data":88518,"sent_data":457,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"md5":"008e644bd253af10034f8d7ed442eda4","sha1":"ceb759782ab9a7ac5dc469966823a392702318b7","sha256":"b557bae85fc621960c3a0857b585cda6eaf5b4cfe3b65cac60b75ce225037dce","sha512":"6d5baa258e52db299bf8a46f7a0fd0d68a8b0c8f982bc9743155087fe49f7449f831c28b4dd57eff60487f32573234231020bd6e88ac487fe9548bb57db9931c","size":1079,"token":"8455617502:AAEnTxZjLC4zPPsVL2YRsrCVYtoQPWwmcbg","is_revoked":false,"bot":{"token":"8455617502:AAEnTxZjLC4zPPsVL2YRsrCVYtoQPWwmcbg","user_id":"8455617502","username":"appsheetzohomail_bot","first_name":"appsheetmail_bot","last_name":"","chat":{"chat_id":"-1003018817001","title":"vkl chinsu dkm kjasfjagsfjakgfakjs","type":"supergroup","bot_is":"administrator","total_users":5,"active_members":null,"admins":[{"user_id":8455617502,"username":"appsheetzohomail_bot","first_name":"appsheetmail_bot","last_name":"","is_bot":true},{"user_id":442232326,"username":"mansinblack","first_name":"Man in Black","last_name":"","is_bot":false}]},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-16T19:52:08Z","timestamp":1760644328,"ip_dst":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.17","port":34694,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)","source":"{\"timestamp\":\"2025-10-16T19:52:08.368071+0000\",\"flow_id\":339084663335071,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.17\",\"src_port\":34694,\"dest_ip\":\"34.117.59.81\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2025331,\"rev\":5,\"signature\":\"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\",\"category\":\"Device Retrieving External IP Address Detected\",\"severity\":2,\"metadata\":{\"affected_product\":[\"Linux\",\"Mac_OSX\",\"Windows_XP_Vista_7_8_10_Server_32_64_Bit\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2018_02_07\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0043\"],\"mitre_tactic_name\":[\"Reconnaissance\"],\"mitre_technique_id\":[\"T1590\"],\"mitre_technique_name\":[\"Gather_Victim_Network_Information\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2024_09_19\"]}},\"tls\":{\"sni\":\"ipinfo.io\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":911,\"bytes_toclient\":1606,\"start\":\"2025-10-16T19:52:08.338079+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"90a1f887460eaac82c0b4b337def6b43","sha1":"04eb715f0b3a512ff95b4ddbd03e9c73f158d928","sha256":"9d17ccc409b69e0f6d1a7b71e565b239d78bad2e67c07f19ddcff9dc8ee26dfc","sha512":"cb67d0bc615354b6f40238cf9da750f2c07f028576d9cb2d7733d769f15cdcd936bc4567157e873121e8589978ce45d340d334901d7a9f702879c02512162e4d","ssdeep":"","tlshash":"97f0f2a7e03d201102e3bb740962a24296f92003124936837b0f41c6bf8fce940b3e2b","size":488,"data":"","first_seen":"2025-07-18T03:55:22.953745Z","last_seen":"2026-05-11T14:30:22.753251Z","times_seen":101,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc6c51c075432652e4421416683c0b0c","sha1":"89501ca429e08daa0ec2e3fbc36f0c5560294d1f","sha256":"d0b6264be1f2a6ac263b2f04049b624cd0ebd38c190cea9dbe44376daa01ba94","sha512":"3be146405953f33605511877bea34d31304e18d3bb883a2ccdc0a0505086b1130f84bb574e900f533f27e4a3e2a97a25177dd6a16d428b8111c24011cd988ddf","ssdeep":"","tlshash":"cbb09b651461308533db5032a79f20016073716764448780391d55122f5676f71527d9","size":122,"data":"","first_seen":"2025-07-18T03:55:22.955993Z","last_seen":"2026-05-11T14:30:22.756635Z","times_seen":97,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-LGMPS657N9","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.168","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"21ba9c6e33e7c35f06149874d81128b3","sha1":"b329161949022be037ca75c0d5248628a9889008","sha256":"6354e67ad0b3bc2f6f1ec928c04cff9db18ae91c230f7b93417da0bf4cc281ae","sha512":"ee8b978b88edd76ef3bfab569fa5054fc3572082e7aa22f046dc6e72c57ea0878d409a909778d09a9dc82ac003247308447833c56e23d6b00cfced0b78237531","ssdeep":"6144:HBIbc6tQSyOe+hy4nkEt7F8KUjxSqpRjeWvkAX6HJLGy1tyyluxwuuSyv:hZ6rRRhy4nkEt7FuEqPeKRy1bv","tlshash":"04941a8e73c674269396f078503f018ba57b29a2f45cc896f189cce42e7499a4277f7c","size":426748,"data":"","first_seen":"2025-10-16T19:52:35.644534Z","last_seen":"2025-10-16T19:52:35.644534Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","size":87533,"data":"","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-14T04:35:11.667588Z","times_seen":185564,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0dadc0a14959e205b61144b99fd3480a","sha1":"fb8964039a5286ebb5d66edac1b1d6d14f887511","sha256":"881cc27df5cf61280c2778a97e14f13d5d98efeaef362260c075e4520362e866","sha512":"5e2129d3bacf7044c2a4d59c27e46182c11471931d096c128d0d56175d300a0c198c3a6bcd3eef1b16a94300598f6d4ff06cfc79a53c779e378b330cf762cf9f","ssdeep":"","tlshash":"64e01aa7f03d201102e3bb780962a34296b92003224975877b0f41c6bf4bcea41b3e1f","size":414,"data":"","first_seen":"2025-07-02T14:15:14.187394Z","last_seen":"2026-06-13T17:35:33.350285Z","times_seen":139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"008e644bd253af10034f8d7ed442eda4","sha1":"ceb759782ab9a7ac5dc469966823a392702318b7","sha256":"b557bae85fc621960c3a0857b585cda6eaf5b4cfe3b65cac60b75ce225037dce","sha512":"6d5baa258e52db299bf8a46f7a0fd0d68a8b0c8f982bc9743155087fe49f7449f831c28b4dd57eff60487f32573234231020bd6e88ac487fe9548bb57db9931c","ssdeep":"","tlshash":"2d11fd4909bb0c451187e0f32297f1006526e42b3504ec28f69cd2e61f8dcb882f33cc","size":1079,"data":"","first_seen":"2025-09-27T17:36:34.965942Z","last_seen":"2025-10-31T16:24:05.967027Z","times_seen":12,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-10-16","alert":"Detects file containing Telegram Bot API","trigger":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"246cdd9342d6df668fd36e314d7a3ffd","sha1":"e7f22a012295f5927074845f8556da9e50390261","sha256":"6e9718d5fbecd8e2f158db327e1e58f2b865bec456b59f058c0b8c65a91ac0b6","sha512":"4e4df852fac01c666fff9f5c3c7e90617b3d87ff9c9ca6be8d716e8849ee23d8c8d1db611f85be8e47727732654e83a74c0afc972ce5c13668060d53824ff3e4","ssdeep":"1536:5wkcpyQYq19XxReciupZvKST0VFsBbGFCVvzBT11EUD97cuqmSIC7HQBEUNpyFx6:G/Uq1d3B2IC7HQBEUSFKyI","tlshash":"b4e3300a33f56432425bb07a592fc60ab335a4472a4aad0c3e5c56dc5f1d87867f2fb8","size":152281,"data":"","first_seen":"2024-02-15T03:47:53Z","last_seen":"2026-06-13T17:35:33.351557Z","times_seen":15221,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"065902e7e28503320be516de92e9c77f","sha1":"23000a0746d4530c7fd295b4a883b43e94f36568","sha256":"fcaf0d13c6746abaeda5ee355d11cafbdeb9d2f4387b143bf74026d107f3cb47","sha512":"a1357411a3cc6283e0b0c29ee867412a16ceb22b9d121b4d8f0e39412c39bc214404b5099a8b08917d21b8b460232aaf70f696ded17bdb2e46df1b3bc08b070a","ssdeep":"","tlshash":"1bc08c8c221b0c70a2b72e050b6fa200b006331294a09a32290a73485f30e03d746814","size":163,"data":"","first_seen":"2025-09-10T12:38:12.986499Z","last_seen":"2026-05-11T14:30:22.757678Z","times_seen":25,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3edd31c7a0371af06d714ca479808dee","sha1":"eaf11285d3b5593d666da6837d6c834f5614f61a","sha256":"32e343a3d26ddd039f4f95587ced16ab59e263fab366741ffbd04cc3a9a11bff","sha512":"d162aebfb3197f1d1be26a003a62a2ef2d43e9adbfaceacc83bbdffd0b64d63ac1f64e577284e92d4c480d0da858609d95388c08a695f57f328c5148f3859f90","ssdeep":"","tlshash":"8941cbec759cc68d45ab705f83cdb4149bf10029f912c412f4cd16821fba892c6138ed","size":2276,"data":"","first_seen":"2024-02-15T03:47:53Z","last_seen":"2026-06-13T17:35:33.352121Z","times_seen":14692,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f36baa560f9fe99dca3c6e3f14a50a41","sha1":"255966b36aae2225e876ec77e9b41a84b1aa8e09","sha256":"2ac3dcc2727e0ab13d4efafea6a3eabaa4efc8d8dcc260008b68d5de940ae75b","sha512":"02719bbd243c7c85d3a50387e63951845e5062bfdd7e964aa1956b4cbd9be0a432d2a04107dc6bde115e2cbb64d5328d405420bd0b1b72a91fd4eeebb3eafba2","ssdeep":"384:yzh6WmEMovpZC5aScji6GCvgp2dJYC9Pq+fkefPd9cDK0Lu2E+UeUNqbIYOvb2Fk:ePsovrC5aRji6GIgpU7odE+ftX96Mq","tlshash":"f4f2aa9e88754b287a66f37665bb0374742a91c7c530b469f85c4a402fcee728069fec","size":36585,"data":"","first_seen":"2025-08-29T03:07:40.825025Z","last_seen":"2025-10-31T16:24:05.970893Z","times_seen":23,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/PrivacyCenter.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/PrivacyCenter.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48560\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"PrivacyCenter.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"74b96e7042a80ca021e3b7ed684c0e7c\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::6tgd6-1760644328001-43175a1ea70b\r\ncontent-length: 65428\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":65428,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 640 x 280, 8-bit/color RGBA, non-interlaced","md5":"74b96e7042a80ca021e3b7ed684c0e7c","sha1":"8fac7029228702fd8783acd66994d074306b3abf","sha256":"82e661b326b8f6d19b06ffed247b6a6a0813fc2d1bd8962322eff28cb0908917","sha512":"b791a6cf04626901829796e7f73f3b833d61c253cf2c8b24e1143ec21ad8c5c86f1aac0bcb9101416472dbdb0f395123ba29ff7eff265021719dd64890c336e6","ssdeep":"1536:XQ60QBLrWGI/74nBepCThZ6XBL1Jz5brkoLtqaP:h06L6xT4n4myLLzZxD","tlshash":"2853021c6a424b3b55df9c3ad56c0fcf20977053004d0a8216a6eebce095fd38a76ee2","first_seen":"2024-09-05T08:59:46Z","last_seen":"2026-08-12T18:51:07.67501Z","times_seen":5158,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-16T19:52:03.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 72981\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:03 GMT\r\netag: \"76c76a65b79425bc9891b9709f9fdc19\"\r\nlast-modified: Wed, 15 Oct 2025 23:35:42 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::sdjlf-1760644323717-04dfea9c38c2\r\ncontent-length: 875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Google Analytics","description":"Google Analytics is a free web analytics service that tracks and reports website traffic.","website":"https://google.com/analytics","common_platform_enumeration":"","icon":"Google Analytics.svg","categories":["Analytics"]}],"data":{"size":1818,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"76c76a65b79425bc9891b9709f9fdc19","sha1":"46131b5d6f1d51e6b3d6935a884623347e307a97","sha256":"44505857db41a78d9d5d7105286032a73553fe6fca0b50bc9766fa15f194e91d","sha512":"d36f062166595e33c69bf45d2ff0e7ac7ec90a049c69a54442c2348105546091d01aaabb3da2b04d51d641603b695e1b5b8e3b7c6e7654fd6fe5cd2557756f5b","ssdeep":"","tlshash":"2331d207f869641401b366717bb1e114e1eba10303802d837a9f18577fb7ad685a3ede","first_seen":"2025-09-10T12:38:12.97903Z","last_seen":"2025-10-31T16:24:05.958765Z","times_seen":24,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":29,"dns":4,"connect":1,"send":0,"wait":10,"receive":11,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/dir.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/dir.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::vzq6z-1760644328020-f583c707ed9b\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"189a501ec3591bfbbf4e42615af1ee95","sha1":"7f75bfbc243b3798d7bb3aec2d4b70a473e5e9de","sha256":"57cc2dd0747e7f23e09b84cc555188a0cf90b741e21071ee3c094f5849966261","sha512":"44981c2530b8b90070d50f29e40f42be5ba947ebe7de433fa1d9bfb0b49f969c7f307673ae099afa3878352625747150c7d64ca228faf6e71529f98fe270114c","ssdeep":"","tlshash":"5aa0110e888a08ae338a08002002ca3a0000032aaea2aa2080ca22202828c8ea3c00e0","first_seen":"2025-10-16T19:52:35.623152Z","last_seen":"2025-10-16T19:52:35.623152Z","times_seen":1,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/ico.ico","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/","date":"2025-10-16T19:52:04.063Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /ico.ico HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:04 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::qnwf7-1760644324066-35c022345d94\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"e70ab94cc693a2ec5d165c8014d16c05","sha1":"03874822273b68783f84ba63e6fe7289ee32c7e9","sha256":"9c76cbe8b59f906a0392fe4b899ee4d749f61921d1b5a8edb7ce7109b9f86db0","sha512":"f1958c0202269b783705af60efc6d2aaa10899be1a946549cc5e7760f1791aa3ffb9d48a0de8877c3e8f27f01b0362922c8dfc47e8e745b9e50b47c728a5e2e7","ssdeep":"","tlshash":"40a0125e0040080c32c02c80900305399001031759539a14408d7730134688da384080","first_seen":"2025-10-16T19:52:35.628463Z","last_seen":"2025-10-16T19:52:35.628463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/save_img.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/save_img.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48560\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"save_img.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"8d3bcd1278891fc1e52d38e72549b3d0\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644328005-83469f2dd592\r\ncontent-length: 7550\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":7550,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit colormap, non-interlaced","md5":"8d3bcd1278891fc1e52d38e72549b3d0","sha1":"af1ab86b5a3993c468c3be9c59a8ed3d9091454d","sha256":"8fc3f44a189200b47c93a90ad8dffe40fcdeda8a718e62bb4baf98f00d536e97","sha512":"e8c73ab69e70bdca02c1c7004947186455c632692311b4ca91d1bea143ce7f0b986dc0b0623b8ae82f9561549337171b3e89a55f7bcd92964fe214ddab1c4feb","ssdeep":"192:ri4sn8ZlCLFUm5Dk3CqDEkV8YaTETosC1nEDuO0f+htV:rfsn4CBnKCqYkaUoseEDuO0C7","tlshash":"d8f18e4d66788d2d74db13ab8c3b69b38d3e2b809e52692ecb574058356962e830fc06","first_seen":"2023-12-25T05:22:02Z","last_seen":"2026-08-13T14:35:02.652953Z","times_seen":15919,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"ipinfo.io/json","fqdn":"ipinfo.io","domain":"ipinfo.io","tld":"io"},"ip":{"addr":"34.117.59.81","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.317Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ipinfo.io","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Sep 2025 06:26:46 GMT","end":"Tue, 16 Dec 2025 06:26:45 GMT"},"fingerprint":{"sha1":"F7:6D:4C:F1:C4:E0:71:B6:08:E9:D6:09:AA:F2:0F:31:4D:06:A9:09","sha256":"61:07:CF:29:5A:BE:51:7D:3A:03:E3:E1:D5:EB:EF:1E:70:26:49:5F:68:6D:49:8F:0C:C9:C9:09:A5:DD:9F:15"}}},"request":{"raw":"GET /json HTTP/1.1\r\nHost: ipinfo.io\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nOrigin: https://casefb918276-2ubg.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nx-content-type-options: nosniff\r\ncontent-type: application/json; charset=utf-8\r\ncontent-encoding: gzip\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\nvary: accept-encoding\r\nvia: 1.1 google\r\nstrict-transport-security: max-age=2592000; includeSubDomains\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":280,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"adf22d9a8ca3a97a9ff78909b8702358","sha1":"f5046826566a7e98d6b5e5c7b0a65677c3bde708","sha256":"756edd1454b049c1370e83c864bc93dfdd82f44d8f9752b3068e5a11867a5de3","sha512":"182391c8c01e54481853a09aa4cf8072496850e45863b198721d0d572e3aa93d8fe11a90bfb24cf97fa64cc132f1594c379474db65db5a1d2207694f770443b9","ssdeep":"","tlshash":"c3d02b6621341b37aeed455c8406960622656e1f1642369f0fe72b0c100c87334f03ae","first_seen":"2023-04-17T17:28:07Z","last_seen":"2026-06-07T07:46:18.554959Z","times_seen":58786,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":58,"dns":21,"connect":13,"send":0,"wait":140,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/ico.ico","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.452Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/ico.ico HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::lgzkw-1760644328456-d94e3ef06b06\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"3f69913a6158a6a59b85a1c87daa06c8","sha1":"546041bb40afc41f5ca7d189ae123d3fa0c191d7","sha256":"523241ae8aa9e38121943d5551ed2fd5cdf2255d31908f9b307a618d1d915e58","sha512":"783c7f0c4949ba028063502975afe1bd34b91f6c1f7047532aca0b0fe78ee8c8eedbcdbbe86601729c8b00eca2d69ba0d4472b51dea9af38fedeeaf599c3cb9e","ssdeep":"","tlshash":"d8a012ae06dc098b32840c10500a11361428015f9a53d920508927041149cced340081","first_seen":"2025-10-16T19:52:35.638943Z","last_seen":"2025-10-16T19:52:35.638943Z","times_seen":1,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/block_2.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/block_2.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 27329\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"block_2.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"8942e3ff39cd6784c7c89bd6eb26d604\"\r\nlast-modified: Thu, 16 Oct 2025 12:16:38 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644327997-9a63766a9bc7\r\ncontent-length: 18787\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":18787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 101, 8-bit/color RGBA, non-interlaced","md5":"8942e3ff39cd6784c7c89bd6eb26d604","sha1":"b03e96fa075ba36fc3d6729fb312f0a59c2a023a","sha256":"9b7c1670777cc38a18fc6b98443b40036fde8de97cdba6087e2a31a1de9e748b","sha512":"af5040882b3ba0d18c56b5cf0cad4c2f8e6fcbabda8b85d0284dab2662a5bab76e38ce6fdd261b27a394d55e58f427aba7edbe8d3a8a33ee422d43cba85bf741","ssdeep":"384:RLwiYUB+GVTS4XHEHc6jMfHrk0T0U0t9424sWnUq5/cYC1/KNk7:miYdvGH+MDk0Y79jjBqRcYcKNe","tlshash":"d782c058d78053e1602cc99617a890bb8a578433259fcc67fa5e88c57fa079d390b3ce","first_seen":"2023-12-25T05:22:01Z","last_seen":"2026-08-13T14:35:02.658342Z","times_seen":15300,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-LGMPS657N9","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.74.168","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://casefb918276-2ubg.vercel.app/","date":"2025-10-16T19:52:03.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Sep 2025 08:40:36 GMT","end":"Mon, 15 Dec 2025 08:40:35 GMT"},"fingerprint":{"sha1":"40:7E:33:E9:D5:23:31:43:6B:CB:8C:02:99:3E:C0:A1:96:B1:B2:DE","sha256":"BE:00:72:E8:21:36:BF:F1:E7:F3:E5:B6:86:FE:98:10:97:9F:3C:C4:3F:0A:F8:4D:E4:62:64:B7:70:FA:56:25"}}},"request":{"raw":"GET /gtag/js?id=G-LGMPS657N9 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Thu, 16 Oct 2025 19:52:04 GMT\r\nexpires: Thu, 16 Oct 2025 19:52:04 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 141785\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":426748,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (6031)","md5":"21ba9c6e33e7c35f06149874d81128b3","sha1":"b329161949022be037ca75c0d5248628a9889008","sha256":"6354e67ad0b3bc2f6f1ec928c04cff9db18ae91c230f7b93417da0bf4cc281ae","sha512":"ee8b978b88edd76ef3bfab569fa5054fc3572082e7aa22f046dc6e72c57ea0878d409a909778d09a9dc82ac003247308447833c56e23d6b00cfced0b78237531","ssdeep":"6144:HBIbc6tQSyOe+hy4nkEt7F8KUjxSqpRjeWvkAX6HJLGy1tyyluxwuuSyv:hZ6rRRhy4nkEt7FuEqPeKRy1bv","tlshash":"04941a8e73c674269396f078503f018ba57b29a2f45cc896f189cce42e7499a4277f7c","first_seen":"2025-10-16T19:52:35.644534Z","last_seen":"2025-10-16T19:52:35.644534Z","times_seen":1,"resource_available":true,"data":null}},"time_used":408,"timings":{"blocked":174,"dns":1,"connect":8,"send":0,"wait":31,"receive":27,"ssl":164},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-16T19:52:07.886Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/Landingpage/landingpage.html HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 72981\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"landingpage.html\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:07 GMT\r\netag: \"39bf584755dfb0fd0d76307fc804066c\"\r\nlast-modified: Wed, 15 Oct 2025 23:35:46 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lgzkw-1760644327901-cd107c75e588\r\ncontent-length: 79366\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery:3.7.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":406166,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1991), with CRLF line terminators","md5":"39bf584755dfb0fd0d76307fc804066c","sha1":"3f30767cf4e0551cff42c6a4203d2f24f0845c08","sha256":"e1c474242805df28c6477cc972fe41f80cc34682a8f19d9ea7b59753583358ce","sha512":"facdb9602f412c530059b64fe6ebc62c1cd7b7a17e247c3845413175139942031ed691839e1769f3cceecdc9bc411bdcb54b917f40b3fcd075d6b6ac47df98c7","ssdeep":"12288:cfII+JI4XLPm1upnFNfDi2SF2V1YIzZRflwut9TWHmW8SClo:36477oSDRfRhlo","tlshash":"6584d765a294523a4033d3ea8e27a726f6b56347d34190853e7c07963fbbd20e153fe8","first_seen":"2025-09-27T17:36:34.937339Z","last_seen":"2025-10-31T16:24:05.929214Z","times_seen":12,"resource_available":false,"data":null}},"time_used":48,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-10-16","alert":"Detects file containing Telegram Bot API","trigger":"casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/styles/bootstrap.min.css","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:07.993Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/styles/bootstrap.min.css HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48561\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"bootstrap.min.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"d85bc7226ee2a8e735679db07264f535\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:46 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lgzkw-1760644328002-10a7457b3e1c\r\ncontent-length: 27114\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":185752,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (334)","md5":"1e55196f4d1ac726e459cb92f86e730f","sha1":"a5c8e91a537085f4289ece6548eb7a36ad180df1","sha256":"b709be7486289a0331a138dc4a691cf45bf71bacbdf3097ad332530c2bc2d23a","sha512":"f7b600bf553dbe9786a11fb7784042dd7d493d85d3a280194cfe10d4f133420baa3cc9a83bec636b4fd5b36af909995a4e36c7041892f804daa83b9b4b6c2383","ssdeep":"1536:7oo0pe3VX8IFqCvnUEE9RMPenjBCFeDm9M5FKBnpNfb:7Ae3TxM5FKBnpNfb","tlshash":"92045499fdf128085a178558a443bbf97b2d1085b709ee79f4a33651e3883c1e4f3e89","first_seen":"2024-09-27T08:41:11Z","last_seen":"2026-07-11T00:11:48.07914Z","times_seen":1354,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/doc.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.017Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/doc.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48560\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"doc.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"95382a6dab40d5911185a921c53e6f6b\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::bwpcg-1760644328005-cf39eeaddcbb\r\ncontent-length: 5723\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":5723,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced","md5":"95382a6dab40d5911185a921c53e6f6b","sha1":"4229cb577571111d747021988aac9dd6cd50634f","sha256":"e341d9055288dfcd7dd5facab6c915f6b7bcffbf80f8b48468c7275b8cada069","sha512":"58dfd1656f931bf14044a8d4d790ccd3369a33d42aea35774bf4b0f2242173795c86fde3280d74849be492bbc50d4515f3f3985f93766559544da37e9988bc03","ssdeep":"96:upH/omZ4SOy3uxD+WxV6jD9/zIvNVCvEknBgSjERtW82iAsuFQAIFbISS2V0wZ:upHRZ3qKvZzMGvBg5RuaAIFc5ohZ","tlshash":"89c1af99f79ec4b282d44b322cab03918b39702160116bed319d9375fe9d74cc9284f1","first_seen":"2023-12-25T05:22:01Z","last_seen":"2026-08-13T14:35:02.660329Z","times_seen":15913,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/fb_round_logo.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/fb_round_logo.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48559\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"fb_round_logo.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"81bb5cf1e451109cf0b1868b2152914b\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:48 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644328011-80d9103c30cb\r\ncontent-length: 42676\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":42676,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"81bb5cf1e451109cf0b1868b2152914b","sha1":"b70017639afc079394be1ea8625f7c4beb44d617","sha256":"676c83478e410d324fe56aca428d3305505732c648667b22e15c8222117c75e6","sha512":"1782966b78f57cc91392f3ff03f05d37e0a5fd8b04b0997b2ef708d13c162ea4aad607e7705a36e0539d6a6b60337432ef271bff062f7170018b42c9b8b81de6","ssdeep":"768:QJ6R1m5mLWd4WdvyQqjv9YRNt2ZDmzqSqBoruj6f3drrFpY85JW81Cl1xB+aArel:QJ41emLWxdv7C8Nt2UzqSuu46v9rvY8I","tlshash":"b613f1da546bcdfec2f950b418ffe653f43ad07b1a8c446fe644eca2ec518a024e2641","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T14:35:02.663929Z","times_seen":15788,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"www.casefb918276-2ubg.vercel.app/","fqdn":"www.casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-16T19:52:03.313Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Thu, 16 Oct 2025 19:52:03 GMT\r\nlocation: https://casefb918276-2ubg.vercel.app/\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-id: arn1::zfb52-1760644323666-a98fcf4433ce\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1818,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":709,"timings":{"blocked":350,"dns":1,"connect":1,"send":0,"wait":10,"receive":0,"ssl":345},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/phone.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.026Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/phone.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 27328\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"phone.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"3c18a93313e72ab9967152a4e92aa238\"\r\nlast-modified: Thu, 16 Oct 2025 12:16:39 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644328013-c82747b59785\r\ncontent-length: 255341\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":255341,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 640 x 280, 8-bit/color RGBA, non-interlaced","md5":"3c18a93313e72ab9967152a4e92aa238","sha1":"74671591dd7cc381c6ec6de1137b83c0e2f4d7ec","sha256":"fbc7addde1cd6057bd59c03941fcf38a6ac17dd90312d142ebd7520891c3656e","sha512":"4533459dba5b435eb888caa9b413a662fb111cd030d5befc6e9b34659fb95031f119de6f80f08f0c8311039073cacf66d3c0bf7acc5146579c3ca70e7f9c9905","ssdeep":"6144:T0ptcriv/k0R7NwRuB6VZfExzYwPlUTsaTq7IT8bbGvAqj:OOev/jNGuUP2hL7ITn","tlshash":"dd4423075785db6223c2bfe74a4e381c4975e8b544d0b5a536e21adf1fc89c7acc628c","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T21:08:22.036975Z","times_seen":17125,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.74.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:07.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Sep 2025 08:41:52 GMT","end":"Mon, 15 Dec 2025 08:41:51 GMT"},"fingerprint":{"sha1":"04:E6:D3:58:E3:A1:E3:05:2B:C3:56:5D:68:BB:1B:0A:08:C6:E3:FB","sha256":"25:4C:B3:A3:9A:E1:D7:FD:25:B6:BF:E9:AA:97:95:20:5D:F2:15:EA:41:46:B6:6B:01:17:19:26:EC:EF:D3:CA"}}},"request":{"raw":"GET /ajax/libs/jquery/3.7.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30462\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 16 Oct 2025 11:46:11 GMT\r\nexpires: Fri, 16 Oct 2026 11:46:11 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 29157\r\nlast-modified: Tue, 12 Sep 2023 02:38:22 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":87533,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"2c872dbe60f4ba70fb85356113d8b35e","sha1":"ee48592d1fff952fcf06ce0b666ed4785493afdc","sha256":"fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a","sha512":"bf6089ed4698cb8270a8b0c8ad9508ff886a7a842278e98064d5c1790ca3a36d5d69d9f047ef196882554fc104da2c88eb5395f1ee8cf0f3f6ff8869408350fe","ssdeep":"1536:0RUX9uDgwxcy2KVBNwchN6SLaHEk2BSrBESp+a/IEk4aAocVi8SMBQ47GKr:sHNwcv9VBQpLl88SMBQ47GKr","tlshash":"3983f8df77ca702247ab30b9006f550bf276199d684d4400f159d8e9bcb8a4a827bf7e","first_seen":"2023-08-31T16:03:19Z","last_seen":"2026-08-14T04:35:11.667588Z","times_seen":185564,"resource_available":true,"data":null}},"time_used":283,"timings":{"blocked":114,"dns":0,"connect":22,"send":0,"wait":21,"receive":25,"ssl":96},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/star.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/star.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48559\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"star.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"aae920faed2a3fe4c3083b339cd783df\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:48 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::k7wr6-1760644328020-725c97889aa9\r\ncontent-length: 1980\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1980,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 41 x 41, 8-bit colormap, non-interlaced","md5":"aae920faed2a3fe4c3083b339cd783df","sha1":"be5e47195c28b585d65478e2399d0d5f9b74435c","sha256":"f75d9bcacc1a1aabc6f93c383f5494307d91f7f302c266626d6dc92b4b86585e","sha512":"968d180a7d9a2fe273a075174f6e7b4561a060f37fd7b1c6f12b2fd7a7d653318672f298245373b15f9aeca1982b2138546f300d48ec2dafaac73f3339147653","ssdeep":"","tlshash":"2d414c54345724a0d24b0be3d2a1bee3e0123e995ce0362c169048b4ffbad49d0e691a","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T14:35:02.659071Z","times_seen":14512,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/dir.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/dir.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: NOT_FOUND\r\nx-vercel-id: arn1::k7wr6-1760644328292-f686051c66cb\r\ncontent-length: 79\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":79,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"a53f76d706353b16a26f331e5158b261","sha1":"f077cc46c00644b016b742e70bf6fbb1bc7c0835","sha256":"2241708e21d1988bc32f06135930986bb0686504a4e3e3ebff53e8dc43aec318","sha512":"adcc53cf819896c8a67a280d4ae4c263ae66254a29e49eb20c5c898872d9183e12cea5cc67da7942a87f3baecb2e074bba85e63d1d119b6d291aca50f08850f6","ssdeep":"","tlshash":"25a0120d00470c8e73c408011102213b040801365a16d65410a9530022488ce935018c","first_seen":"2025-10-16T19:52:35.670676Z","last_seen":"2025-10-16T19:52:35.670676Z","times_seen":1,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/styles/style.css","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/styles/style.css HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48561\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"style.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Thu, 16 Oct 2025 19:52:07 GMT\r\netag: \"93fa764f7ccfb9526008436fe42ffd35\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:46 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::6tgd6-1760644327995-3963a543f0bc\r\ncontent-length: 2885\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":12696,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"255fd3683d6cb6db21e14071ce9aac6c","sha1":"c69c3ed3b255e5afa404f4e6c9638599e3a2737f","sha256":"b1b8e6ca3cb16f272e98f66fe931e659c67671dcf9c9548711a1714d5f230af4","sha512":"77f6313ef30f1292d1d476dc7ad41df75a61b9ae01424c18727491ab7c1759397a174ed04e018b4ed25fd7ab6b2fbe02c6e208b8b09ead29f7e266b4f4a1adac","ssdeep":"192:fvO/e/RMi7fg9CWd7xkxPdl7o98ZZBDeuyiKfJLFF52ae5FD909Ghv0nxGazzDjK:f1J7r5QFsHFE4vajtY","tlshash":"ab42d18a9ee721497516d4742bba5b45e362c023c54aceed3edc329ccf893c45de9388","first_seen":"2024-09-20T16:38:26Z","last_seen":"2026-07-11T00:11:48.091901Z","times_seen":3873,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/meta-logo-grey.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/meta-logo-grey.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 72980\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"meta-logo-grey.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"ffba640622dd859d554ee43a03d53769\"\r\nlast-modified: Wed, 15 Oct 2025 23:35:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644328007-213a8bfc2a12\r\ncontent-length: 105511\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":105511,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 900 x 240, 8-bit/color RGBA, non-interlaced","md5":"ffba640622dd859d554ee43a03d53769","sha1":"c91a100db7bfc04df9a5f3223d5b6f17536bf5ee","sha256":"139d38d0fbfed2fd9f2b782af9b3eb08005b9bc75faaa31fe29720cc64bcab0f","sha512":"70c7c4df14a22e00a0caf1daf001e608454604fa0b4c13583efac7a8caff6c726d62c024f9e0626760b524f7d08184e4e30cf4a49be505acb1f9d29cfce35993","ssdeep":"1536:VudXKa4pprle5L3Ve48HXzXl4F4fTy9AeC9hhxVK0cYUFLWyMjmy/Yu:/xe5UHDaCTy9bmPJURWBjma","tlshash":"efa3022ee1d5311eced3515032d47e985a86ace5cf421c08758cca9b8f34e994aed3ea","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T14:35:02.661291Z","times_seen":15751,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/no_avatar.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/no_avatar.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 72980\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"no_avatar.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"d5d30f28ca92743610c956684a424b7e\"\r\nlast-modified: Wed, 15 Oct 2025 23:35:47 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::vzq6z-1760644328022-1ce666479e5f\r\ncontent-length: 6043\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6043,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"d5d30f28ca92743610c956684a424b7e","sha1":"fd4a7207b724254d981a4ed4c7f675fd87868535","sha256":"4b842e25c6be485fd7f06b745ac91db2b6e9eee778c5442b157be78d51f83563","sha512":"7d0a522805b0a34b33f48791bbbfdfc361b9d91ee9d5843d67e8e1a774f9d8dad42c7d0efa429738a0680fcb8d71dacc4b47e22f1daa8ce718dbf36e6db35328","ssdeep":"96:s7xaydiMkBvGfzBKIFuC/bG6UAlQloqPZ6UtCjcphNixjT0vtK9E0NJGNKIX3D7b:s7xxr3oFloqPHtCQViV0vMVUj3D71rrx","tlshash":"fec19ee35fd67937430ad6fb6ee962c62b416188acb5f24c023373406157c548fa5e2d","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T14:35:02.665816Z","times_seen":14554,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"www.casefb918276-2ubg.vercel.app/","fqdn":"www.casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-16T19:52:01.345Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":461,"timings":{"blocked":461,"dns":0,"connect":1,"send":0,"wait":0,"receive":0,"ssl":345},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"www.casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/Mate.mp4","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://casefb918276-2ubg.vercel.app/","date":"2025-10-16T19:52:03.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/Mate.mp4 HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 206 Partial Content\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 72981\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"Mate.mp4\"\r\ncontent-range: bytes 0-292265/292266\r\ncontent-type: video/mp4\r\ndate: Thu, 16 Oct 2025 19:52:03 GMT\r\netag: \"10b6a79b6905a100feb12b61fed435b8\"\r\nlast-modified: Wed, 15 Oct 2025 23:35:42 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::qnwf7-1760644323921-275a99a39d14\r\ncontent-length: 292266\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":292266,"size_decoded":0,"mime_type":"video/mp4","magic":"ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]","md5":"10b6a79b6905a100feb12b61fed435b8","sha1":"0cc399458bb86e12ebcc7f81a34d7d18d4200d21","sha256":"2fb6e516e0120a67c26d56cfc201f81f88eee2cd5df9bb5019fc79af6b5650a4","sha512":"007dd3e24cf29493f78f112dc283b629e92b92173ba6660f021538f0926c87d133f7cde131d4241ff3fad5ceee0a2b090695948ee709820b0f271b1826384a5a","ssdeep":"6144:E/I+AeDkczPdLzS93F84WbJcbULlHZkO/+b8ffur4+8SpUAHc:E/LAeDU1F8C4xl+A+rb8Suec","tlshash":"ce5423aaa3d97305cf748a39c04ec365e25cfa866a971bf7b0c1ae470116059ce9c73d","first_seen":"2024-06-01T18:50:06Z","last_seen":"2026-08-14T03:22:35.900085Z","times_seen":5999,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}},{"url":{"schema":"https","addr":"casefb918276-2ubg.vercel.app/managermentloc/img/2FA.png","fqdn":"casefb918276-2ubg.vercel.app","domain":"casefb918276-2ubg.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html","date":"2025-10-16T19:52:08.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 24 Aug 2025 16:25:33 GMT","end":"Sat, 22 Nov 2025 16:25:32 GMT"},"fingerprint":{"sha1":"65:BC:A7:BA:F4:02:35:5A:8E:26:1A:28:11:13:6E:A9:04:93:AF:53","sha256":"4A:D3:2C:0E:A9:6E:49:2B:0F:83:76:28:51:24:AD:FC:65:D0:91:9D:87:49:B8:B5:AE:97:5D:33:87:86:7D:7C"}}},"request":{"raw":"GET /managermentloc/img/2FA.png HTTP/1.1\r\nHost: casefb918276-2ubg.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://casefb918276-2ubg.vercel.app/managermentloc/Landingpage/landingpage.html\r\nCookie: _ga_LGMPS657N9=GS2.1.s1760644324$o1$g0$t1760644324$j60$l0$h0; _ga=GA1.1.1282557941.1760644324\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 48559\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"2FA.png\"\r\ncontent-type: image/png\r\ndate: Thu, 16 Oct 2025 19:52:08 GMT\r\netag: \"03d39d5d071182aba1b01ba2e859de39\"\r\nlast-modified: Thu, 16 Oct 2025 06:22:48 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::bwpcg-1760644328013-ef85860f5c7d\r\ncontent-length: 114767\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":114767,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 541 x 252, 8-bit/color RGBA, non-interlaced","md5":"03d39d5d071182aba1b01ba2e859de39","sha1":"7ba8f968b03e92fd59a6c4f6ce5c8aa36a5d2b92","sha256":"a7fd65363687e512751d88f7850b61969427e8d3aa9a177946bcd4bc280b71ad","sha512":"5bf4d0b9ff650ff11c8ff69c409c45fbfd31bc3f8c4b55f665bea8e11a42c412b9ea25b9974908ab9b670a22e80a445692a26b98535b84cb49299c37c22e16e6","ssdeep":"3072:SOEFifYmNYKElSiLVN6MOzKqJdnJYJe4kiUh6sq:SIZYKEzmXZdJ8eYx","tlshash":"3cb31251b4a03e28e812f3ea73d7f49a4c71e374785d41a294047ec7e72da56f04afa4","first_seen":"2024-01-09T09:55:04Z","last_seen":"2026-08-13T14:35:02.664569Z","times_seen":9891,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-10-16","alert":"Phishing Block","trigger":"casefb918276-2ubg.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-16","alert":"Sinkholed","trigger":"casefb918276-2ubg.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Facebook","verdict":"phishing","severity":"medium","comment":"Resource associated with Facebook phishing","tags":["meta","facebook","phishing","social"],"meta":null}]}}]}