{"report_id":"7578d464-0ac7-4ab9-a7fe-8601548f77b5","version":0,"status":"done","tags":[],"date":"2026-08-15T18:33:30Z","url":{"schema":"http","addr":"guiatotalbrasil.com/DocuSign/Mac/utility.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"ip":{"addr":"38.58.181.243","port":0,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"guiatotalbrasil.com/DocuSign/Mac/utility.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"title":"e-sign","dom":{"size":302599,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65389)","md5":"07b869be3c92d0b2d627338a3dc9796e","sha1":"5dd9525b8feb16f545b91da6ad46c55bf7447cd1","sha256":"d1b2fc7ef50cb4947722505977eb08d38dccf40c7077876e101dd9a3d702552d","sha512":"d727c6ebcaf5b123314dadbfbcd6adc116beb11e15d5a2d2e4e8ef73aa300d26289b2126d0eae3d8942bd3baa0efe0b6f6690f6c64fad5c50dec732e20b7bd07","ssdeep":"6144:6Edo2Cp6Edo2CpfUNuO+L6qFnxw7Ap27rpZioc:6Edo2Cp6Edo2CpfUNuODqFnqkp27rpZk","tlshash":"3754123157813dbb583cca8c72d13e842ed8decfc6b8524135f5a0e282ee752adb1259","dom_hash":"domhasha54d4d55d051a5234c8cada3651a2beb","first_seen":"2026-08-15T07:41:38.439927Z","last_seen":"2026-08-15T18:33:33.601573Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"guiatotalbrasil.com/DocuSign/Mac/utility.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"ip":{"addr":"38.58.181.243","port":0,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-19T18:33:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-15","alert":"Sinkholed","trigger":"guiatotalbrasil.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-15","alert":"Phishing Block","trigger":"guiatotalbrasil.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"guiatotalbrasil.com","ip":{"addr":"38.58.181.243","port":443,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"domain_registered":"2025-06-08","domain_rank":0,"first_seen":"2026-06-05T17:14:39.623927Z","last_seen":"2026-08-15T07:41:37.673806Z","alert_count":4,"request_count":2,"received_data":6133093,"sent_data":1038,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Google PageSpeed:1.13.35.2","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"guiatotalbrasil.com/DocuSign/Mac/utility.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"ip":{"addr":"38.58.181.243","port":443,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"a0550809b8647fba8044066b1a2ae77d","sha1":"0d133745ffacbdec10e755a066c40a262fb67215","sha256":"f96e4f5b05f8a393344fb98b5025b2ab69a79377c503b964d146972fed78c1f5","sha512":"db7a90c098180f5ce3615d47ed441606e8965b49e60d027bf49b5642e55e5b0f4354f869e0e31a04dfaf765c04edc3eaf5b99476857474f42786753976a43ec7","ssdeep":"","tlshash":"a2a0228e2820838802a22222c83b2a8a203333a30800c3000c200c0c22283cf802f8cb","size":72,"data":"","first_seen":"2026-08-15T07:41:38.445986Z","last_seen":"2026-08-15T18:33:33.60467Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"guiatotalbrasil.com/DocuSign/Mac/download/index.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"ip":{"addr":"38.58.181.243","port":443,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-15T18:32:55.763Z","timestamp":1786818775763,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"guiatotalbrasil.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 24 Jun 2026 23:37:56 GMT","end":"Tue, 22 Sep 2026 23:37:55 GMT"},"fingerprint":{"sha1":"4E:50:5A:C1:2F:EB:AC:AD:42:97:E4:09:20:D8:4E:D0:3D:E2:52:FA","sha256":"B7:7E:B1:C1:1D:52:AF:ED:8B:A9:BC:A4:33:19:3B:14:21:6F:48:99:5B:A7:53:D4:71:51:88:38:FE:2B:E4:0C"}}},"request":{"raw":"GET /DocuSign/Mac/download/index.php HTTP/1.1\r\nHost: guiatotalbrasil.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-description: File Transfer\r\ncontent-disposition: attachment; filename=\"docusign.dmg\"\r\npragma: public\r\nexpires: 0\r\ncontent-length: 5829950\r\ncache-control: must-revalidate, s-maxage=10\r\ncontent-type: application/octet-stream\r\ndate: Sat, 15 Aug 2026 18:32:55 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5829950,"size_decoded":320,"mime_type":"application/octet-stream","magic":"zlib compressed data","md5":"2bb9197f59e9f58baf09efa5781df5e0","sha1":"9d54a3b3a53722417f109a54712f4c23f2225159","sha256":"c9c043f55f56d0bb810c2f18894406be5d39080dd079a6552e57c514481e7446","sha512":"7f0dd4537bc858e0e973871ac9a51521d45004eae0a492e17f81aad325354710dd2ceda084a17b34cfea51b86424b019c75e8e91dcb80e916ac2ffb514cc5f4d","ssdeep":"24576:JpZEEKuG0Inx+vc5uTyQrYKu6GY+LqURLG:vZEoGLnx+aQM/RLG","tlshash":"132533cb5ebfb7b8ef674fb640052ad6ad25870e5fde4861f88c8ca4e9d81508134427","first_seen":"2026-05-05T22:36:13.901746Z","last_seen":"2026-08-15T18:33:33.603014Z","times_seen":57,"resource_available":true,"data":null}},"time_used":847,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":160,"receive":687,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-15","alert":"Sinkholed","trigger":"guiatotalbrasil.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-15","alert":"Phishing Block","trigger":"guiatotalbrasil.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"guiatotalbrasil.com/DocuSign/Mac/utility.php","fqdn":"guiatotalbrasil.com","domain":"guiatotalbrasil.com","tld":"com"},"ip":{"addr":"38.58.181.243","port":443,"asn":26042,"as":"FIBERSTATE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-15T18:32:51.241Z","timestamp":1786818771241,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"guiatotalbrasil.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 24 Jun 2026 23:37:56 GMT","end":"Tue, 22 Sep 2026 23:37:55 GMT"},"fingerprint":{"sha1":"4E:50:5A:C1:2F:EB:AC:AD:42:97:E4:09:20:D8:4E:D0:3D:E2:52:FA","sha256":"B7:7E:B1:C1:1D:52:AF:ED:8B:A9:BC:A4:33:19:3B:14:21:6F:48:99:5B:A7:53:D4:71:51:88:38:FE:2B:E4:0C"}}},"request":{"raw":"GET /DocuSign/Mac/utility.php HTTP/1.1\r\nHost: guiatotalbrasil.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-mod-pagespeed: 1.13.35.2-0\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncache-control: max-age=0, no-cache, s-maxage=10\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 15 Aug 2026 18:32:52 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Google PageSpeed:1.13.35.2","description":"Google PageSpeed is a family of tools designed to help websites performance optimisations.","website":"https://developers.google.com/speed/pagespeed/mod","common_platform_enumeration":"","icon":"Google PageSpeed.svg","categories":["Caching","Web server extensions","Performance"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":302569,"size_decoded":218961,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65389), with CRLF line terminators","md5":"aef0c753b6f4ff9cd86a28092226c249","sha1":"439c07e416b51bb3e3c17a091bd9f659b8b073c5","sha256":"40f12c6be8199f49f8e964a3fb7f3d0ce414cfe40f60ecb41443d22f19a849b0","sha512":"84c2803a2c7e247b780a9ad5739177fca00a7d436ef88099d967d5cf59cb7aa2afe0989db39f32482a7fd982ec8407e236aeee95f554c3e90e532e59792b36d6","ssdeep":"6144:QEdo2Cp6Edo2CpplNuO+L6qFnxw7A+27rpZioV:QEdo2Cp6Edo2CpplNuODqFnqk+27rpZt","tlshash":"ed54123157813dbb583cca8c72d13e842e98decfcab4924135f5a0e382ee751adb1259","first_seen":"2026-08-15T07:41:38.444139Z","last_seen":"2026-08-15T18:33:33.603597Z","times_seen":2,"resource_available":false,"data":null}},"time_used":998,"timings":{"blocked":-1,"dns":373,"connect":135,"send":0,"wait":217,"receive":0,"ssl":272},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-15","alert":"Sinkholed","trigger":"guiatotalbrasil.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-15","alert":"Phishing Block","trigger":"guiatotalbrasil.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}