{"report_id":"7641be91-6e1f-4e32-811c-6a16b6ef83d4","version":6,"status":"done","tags":["microsoft","phishing","suspicious","telegram_bot"],"date":"2025-11-11T21:21:25Z","url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.3","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"title":"Outlook","dom":{"size":12393,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"dafa5a160d595d937c372b42df8b5bc3","sha1":"0dbc7cb201e47f74f2324388e02abefc893526aa","sha256":"7bd76afec64c3c2bdbc316096d5dd89edbde1cf7f9db0798a461822b7c08d734","sha512":"634568e378772e17acd07ebdfbfd5bc4ede400a8cf4cefd3346798072524c449b1b77828d29094b7a506ab34fc9a0c8d1ee6c9c45d7993a7dba175f96d62756a","ssdeep":"192:3AYp83KmOSxlgre0oW/8IsEV/xf+r7heZqMzDLr:3BpYKmPIBRx2Kqe","tlshash":"5542a54b74b311a13ab350b0a77bb1043277d01f6c09d8487a9dc7286f49e5aaa777ce","dom_hash":"domhash730b7f5ecc29ee9f8f32404ca6fe526d","first_seen":"2025-11-11T16:02:29.587775Z","last_seen":"2025-11-12T10:32:18.946532Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.3","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-16T21:21:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":3,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-11T21:21:04Z","timestamp":1762896064,"ip_dst":{"addr":"104.237.62.213","port":443,"asn":18450,"as":"WEBNX","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.8","port":42894,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-11T21:21:04.184269+0000\",\"flow_id\":1519003914673757,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42894,\"dest_ip\":\"104.237.62.213\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api64.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":789,\"bytes_toclient\":4668,\"start\":\"2025-11-11T21:21:03.859741+0000\"}}"}],"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-11-11","alert":"Detects file containing Telegram Bot API","trigger":"cache-owa-autodiscover-refreshv4.vercel.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-11-11T16:02:26.59808Z","last_seen":"2025-11-11T16:02:26.59808Z","alert_count":34,"request_count":8,"received_data":159868,"sent_data":3994,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Webflow","description":"Webflow is Software-as-a-Service (SaaS) for website building and hosting.","website":"https://webflow.com","common_platform_enumeration":"","icon":"webflow.svg","categories":["Page builders","CMS"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}]},{"fqdn":"cdn.prod.website-files.com","ip":{"addr":"104.18.161.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-01-23","domain_rank":20159,"first_seen":"2023-11-01T22:05:38Z","last_seen":"2025-11-09T23:50:20.752482Z","alert_count":0,"request_count":2,"received_data":2238,"sent_data":1112,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"d3e54v103j8qbb.cloudfront.net","ip":{"addr":"54.230.245.192","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2008-04-25","domain_rank":0,"first_seen":"2016-03-11T23:08:14Z","last_seen":"2025-11-09T23:50:21.047449Z","alert_count":0,"request_count":1,"received_data":90093,"sent_data":567,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"api64.ipify.org","ip":{"addr":"104.237.62.213","port":443,"asn":18450,"as":"WEBNX","country":"United States","country_code":"US"},"domain_registered":"2014-01-05","domain_rank":26688,"first_seen":"2020-08-17T05:58:17Z","last_seen":"2025-11-10T19:36:29.000887Z","alert_count":0,"request_count":1,"received_data":214,"sent_data":544,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2025-11-09T22:19:26.142871Z","alert_count":0,"request_count":1,"received_data":90137,"sent_data":451,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"md5":"96a3a7c12f42020cd87fe2cfd37468a3","sha1":"6a4754a86091135ce35ec32e63ac420184ed3eed","sha256":"5355a1fc0153e4d807f109b5fd3832c7269315c8cd13c3955858da5b53f715d1","sha512":"1483ac0f007113a18a1dcab2df92a46cfc39fa6f4cb7501b154540faec2603af2ce4a87c895a4e027edc32566a3f52b8c364cae545446c4f352d66767bdcd572","size":6622,"token":"8492588783:AAENb9XkfvvnkZWcZPEcePB88EX0gJZguMw","is_revoked":false,"bot":{"token":"8492588783:AAENb9XkfvvnkZWcZPEcePB88EX0gJZguMw","user_id":"8492588783","username":"owamodelogs_bot","first_name":"owamodelogs","last_name":"","chat":{"chat_id":"7241128758","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-11T21:21:04Z","timestamp":1762896064,"ip_dst":{"addr":"104.237.62.213","port":443,"asn":18450,"as":"WEBNX","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.8","port":42894,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","source":"{\"timestamp\":\"2025-11-11T21:21:04.184269+0000\",\"flow_id\":1519003914673757,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.8\",\"src_port\":42894,\"dest_ip\":\"104.237.62.213\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2047703,\"rev\":1,\"signature\":\"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_and_Server\"],\"confidence\":[\"High\"],\"created_at\":[\"2023_08_22\"],\"deployment\":[\"Perimeter\"],\"performance_impact\":[\"Low\"],\"reviewed_at\":[\"2023_08_22\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"External_IP_Lookup\"],\"updated_at\":[\"2023_08_22\"]}},\"tls\":{\"sni\":\"api64.ipify.org\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"f4febc55ea12b31ae17cfb7e614afda8\",\"string\":\"771,4865,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":789,\"bytes_toclient\":4668,\"start\":\"2025-11-11T21:21:03.859741+0000\"}}"}]}],"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0e9e3ad57abeefde87342864450cc232","sha1":"4dc8676bf3417d597053d5f253fce034007f63da","sha256":"9a37601d1f5a5f2fba3b000694d4bf5e035c606d5485dd94e2997cbe2efe5c26","sha512":"b2d8e0e883fc8af91de120565298502b6e5b0f6e20275ecd2974de3e768a19a443f7facc2127201df66725c20451b924a69eaab78224073e385f14a5431c3a6c","ssdeep":"","tlshash":"34c0123621525559045b3d04a66ba14a758791b2a9025401dc7ee5a0311bc9aad0255e","size":181,"data":"","first_seen":"2023-03-07T01:17:43Z","last_seen":"2026-08-16T21:31:19.667664Z","times_seen":59823,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","size":89501,"data":"","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-08-16T21:46:41.326465Z","times_seen":498523,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=68f89e5e044f107c8074cdb5","fqdn":"d3e54v103j8qbb.cloudfront.net","domain":"d3e54v103j8qbb.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"54.230.245.192","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","size":89476,"data":"","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-16T21:38:41.264131Z","times_seen":267254,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0d06542d59a345137b2f65d0b81cb186","sha1":"11f178e1946c0a9e435a5080e7c9f9ea4f2dcf28","sha256":"04fc235ada215a90394969588298c861a970e01193a111fce614b4f231cb616e","sha512":"151c80b1b8788771310d1f05ec4f9a8a3a84f74123c033891881618ee584d01ec469edd0f5662ef4de3e84ecda0b7ce1e37df8789022b4d33cc0f9459837e951","ssdeep":"","tlshash":"3e118842395311e01df325b1b74fb29432eb95ab7c04e845ba4dc3006f59e0bbe1b6e5","size":855,"data":"","first_seen":"2025-11-11T16:02:29.610064Z","last_seen":"2025-11-12T22:44:02.013267Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/js/webflow.js","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3cba4fe138cdf0a533a9133762974504","sha1":"b9a99489f727cb71dbc6b432e2fc2762452c7141","sha256":"eda310cbf970ff74be6656156df5b4c7379e7e125b1a997b925058176fac841a","sha512":"bfc6d6e1c029b585a154d4b69c997a194cc75e5d96e3068dd3ab0e160f8dd6e664774580b8ca9cd24b84b2f9321f3ed2f11661eca93f4e1cb5d169ac5c858ee8","ssdeep":"768:eimnVBXOPE29VhZjEM37KbRW5erJVBlv26+tvCvTd9fKV5f8b1Sr6zFT4F7kz6:KnVBXOP9W9B7vTd9fvhg5","tlshash":"8b13d5ceb285b4b613d362f0905f9309623b5555744a484cf23ad8e57e78d8ca12bfbc","size":41716,"data":"","first_seen":"2025-11-10T13:01:06.818655Z","last_seen":"2026-06-13T05:06:19.39163Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"96a3a7c12f42020cd87fe2cfd37468a3","sha1":"6a4754a86091135ce35ec32e63ac420184ed3eed","sha256":"5355a1fc0153e4d807f109b5fd3832c7269315c8cd13c3955858da5b53f715d1","sha512":"1483ac0f007113a18a1dcab2df92a46cfc39fa6f4cb7501b154540faec2603af2ce4a87c895a4e027edc32566a3f52b8c364cae545446c4f352d66767bdcd572","ssdeep":"48:tibpxnUiZvxfDA1PpAp+hOhA3osPVnBiKlaCiKj4O5CduFd+iH+cj43He2C3/qzU:exjcE+hfZ7heiOT+Q2I50+uG7v3LTMX","tlshash":"72d1d08f75b322b02ab7a075572fa1013237945f3c09d944799ec7242f44e2ea6b77ca","size":6622,"data":"","first_seen":"2025-11-11T16:02:29.611389Z","last_seen":"2025-11-12T10:32:18.957767Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-11-11","alert":"Detects file containing Telegram Bot API","trigger":"cache-owa-autodiscover-refreshv4.vercel.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/images/image.png","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-imageset","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.816Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /images/image.png HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33165\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"image.png\"\r\ncontent-type: image/png\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"fa0ebf131ad8eff98804b8c0685f2b94\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:18 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lvbfj-1762896063815-eab5f453acb4\r\ncontent-length: 47108\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47108,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 546 x 146, 8-bit/color RGBA, non-interlaced","md5":"fa0ebf131ad8eff98804b8c0685f2b94","sha1":"20073cfca7970c2a7e8869c92c8758e8de40db50","sha256":"ba35a4cef2ea9aefb1ce06d0061d172bc49ff9b8a001bc8089376a3fc21eaf4e","sha512":"0384648c737953e5048325802834b95016e4c9b021b1dbbfb23f61070b0cf5c496725541f38321e6ee00c5d5ebcc03873f2635e948738ad90dc64596d10f2a67","ssdeep":"768:a2btD2/LL1SK3kP6K+C7MRrpKSEfhKcXiputvaTvB2+Jx74SODrtyGql2YYi6wSG:a25CX3wJUPEhXIsSTv/USOqpYiuG","tlshash":"42230161caccf80e088219cbcf16eec01935afd5295655879f62f5c92807bfa1db607a","first_seen":"2025-11-11T16:02:29.589798Z","last_seen":"2025-11-12T22:44:01.995145Z","times_seen":7,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.prod.website-files.com/68f89e5e044f107c8074cdb5/68f8b899298663920f95c938_157bece9-7026-47eb-bbff-eae4174424f0-2.png","fqdn":"cdn.prod.website-files.com","domain":"website-files.com","tld":"com"},"ip":{"addr":"104.18.161.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prod.website-files.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Oct 2025 20:20:26 GMT","end":"Thu, 08 Jan 2026 21:20:23 GMT"},"fingerprint":{"sha1":"36:73:72:40:FB:41:28:BD:49:77:FB:90:5B:2E:02:FA:18:98:46:F3","sha256":"9A:F2:2E:A6:DB:A5:41:83:DC:C8:50:D9:A2:A6:B3:44:A8:AC:3F:1E:23:9C:EA:65:A2:FF:1F:93:59:1D:E2:FC"}}},"request":{"raw":"GET /68f89e5e044f107c8074cdb5/68f8b899298663920f95c938_157bece9-7026-47eb-bbff-eae4174424f0-2.png HTTP/1.1\r\nHost: cdn.prod.website-files.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 454\r\ncf-ray: 99d0d64f1af7c759-OSL\r\nx-amz-id-2: PUhfX+Hb0HmqVUdRP1mE1WsOiFKSUw1Kc5Yaj7O+vULdnTncsVpn0jS1slICAF58uCB9n7LJvjM=\r\nx-amz-request-id: 5AFNQ8VBV55928MD\r\nlast-modified: Wed, 22 Oct 2025 10:57:31 GMT\r\netag: \"0789552787bc47afbcffe31ddca2c3e2\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000, must-revalidate\r\nx-amz-version-id: TnjwhuOvISPNFC3qTUvO74SQC0Gedz6E\r\ncf-cache-status: HIT\r\nage: 46323\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":454,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"0789552787bc47afbcffe31ddca2c3e2","sha1":"6a2ec3f9e415c47275fdbb434f9e12cb60642d59","sha256":"4cbc854a094d90e4768db969fe982da85faf57f4132c71279e4fd0a81a378e2d","sha512":"76df4eb4c7d72a6934011c6e0c174c2946280296756b8c2951a54509b988e324ce0bf28ec06b07feb216a37c767f3d5bce447b8743f4d8c3a1150921c0c5511b","ssdeep":"","tlshash":"abf0d45f0173c8e78f055b752929b503a8163526ddcd43750b5184792d1002ed9d1c4e","first_seen":"2025-11-11T16:02:29.59235Z","last_seen":"2025-11-12T22:44:01.999266Z","times_seen":7,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":0,"connect":1,"send":0,"wait":96,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=68f89e5e044f107c8074cdb5","fqdn":"d3e54v103j8qbb.cloudfront.net","domain":"d3e54v103j8qbb.cloudfront.net","tld":"cloudfront.net"},"ip":{"addr":"54.230.245.192","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cloudfront.net","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Mon, 05 May 2025 00:00:00 GMT","end":"Thu, 23 Apr 2026 23:59:59 GMT"},"fingerprint":{"sha1":"8F:00:F1:34:A7:1E:27:1C:CF:CD:A6:53:8B:C4:82:B0:68:BC:C8:72","sha256":"60:38:9D:24:9E:41:8F:23:AC:D9:14:5C:A3:47:7E:AF:07:DB:9F:2D:6A:8C:0D:08:E9:24:8A:8E:49:A9:4D:28"}}},"request":{"raw":"GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=68f89e5e044f107c8074cdb5 HTTP/1.1\r\nHost: d3e54v103j8qbb.cloudfront.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://cache-owa-autodiscover-refreshv4.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET\r\naccess-control-max-age: 3000\r\nlast-modified: Mon, 20 Jul 2020 17:53:02 GMT\r\nserver: AmazonS3\r\ncontent-encoding: br\r\ndate: Mon, 10 Nov 2025 23:17:48 GMT\r\ncache-control: max-age=84600, must-revalidate\r\netag: W/\"dc5e7f18c8d36ac1d3d4753a87c98d0a\"\r\nvary: accept-encoding\r\nvia: 1.1 6a0f63864791329e89a4b233ec4c3a36.cloudfront.net (CloudFront)\r\nage: 79396\r\nx-cache: Hit from cloudfront\r\nx-amz-cf-pop: OSL50-P1\r\nx-amz-cf-id: 6NeoPOIHDw4HJINnX3IWaC_NHsFw__lkImmkZ_Ry0e-OHuKyCj3brg==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":89476,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"dc5e7f18c8d36ac1d3d4753a87c98d0a","sha1":"c8e1c8b386dc5b7a9184c763c88d19a346eb3342","sha256":"f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d","sha512":"6cb4f4426f559c06190df97229c05a436820d21498350ac9f118a5625758435171418a022ed523bae46e668f9f8ea871feab6aff58ad2740b67a30f196d65516","ssdeep":"1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1","tlshash":"a993f9ddb2c6702257a720ba007f510bf236199d6c4d8450f265d8e9bcb8a4e827bf7d","first_seen":"2023-03-07T01:02:01Z","last_seen":"2026-08-16T21:38:41.264131Z","times_seen":267254,"resource_available":true,"data":null}},"time_used":71,"timings":{"blocked":21,"dns":26,"connect":1,"send":0,"wait":9,"receive":0,"ssl":11},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/css/normalize.css","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /css/normalize.css HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33166\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"normalize.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"4e39b188cc9688c9e641098c3ec9afb9\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:17 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pnj2m-1762896063444-3b5bdaf372af\r\ncontent-length: 2789\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7772,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"afb4942e5838a7dc3b63d00ffcc87c9d","sha1":"f1a4ae2fbaa13ef9d9500648d5a16f7adaa88d30","sha256":"0d336a97efd52a4ef44ef3270e71eac24ba405d4450016f9d3e943256e9e58c8","sha512":"8b897ca084c9e5aba585a3c8036ca2b9e10243e262e93f0761635db00d1da2544803f8937163d278e94c4d6ff6b23031f87660b55a9000a72211bb27a3ebab7e","ssdeep":"96:MrWcFPpkRUwojaszRO5LVSrwnTgPjnRo5wUEKs2NE4P+49NaN71UB9:M/9pVjasdEvQnRo2UEKsSBP+W67w","tlshash":"82f1b59923a04b9252395df5f3a7938533481127832c7c6eb4d240fc8fc8b5553baf99","first_seen":"2023-04-05T04:08:19Z","last_seen":"2026-08-16T22:09:53.437745Z","times_seen":3752,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/css/webflow.css","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /css/webflow.css HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33166\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"webflow.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"105bebd34971c558cdcfea3691625863\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:17 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zrjbt-1762896063444-77cb83ce3675\r\ncontent-length: 9980\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":38513,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (2587)","md5":"3fcf706846ade70160d14df3203261da","sha1":"bc3f2f1c5dff6acbed363fa88b53d90dd288b91c","sha256":"b2dfaf5cd1b774b3358e45375f126b55571cc71e713f6f9da535ca9d8286c580","sha512":"8d982c204aa408e4aef2d0cda5c3fb7b99b0eec5a7b5313205eec0fe6ecfa38687d4c37431e0b74a435d10d5c9f17e5ab04c2cfaa5299476a0edc5d3d7568af0","ssdeep":"768:ef7A1YRQ/VHrFIfoF7GpFMDw82aWoS+lyKA+vdxxF3F5FiwFt24lLqClUZ6CE7WP:t1YWtHr5KCPxljdRLqCqE2kQR","tlshash":"eb0394b58bf40620b817c1a56890a3657f2d4003b74ede28bae1741fdfce1c79963b69","first_seen":"2025-04-18T14:25:13.661476Z","last_seen":"2026-08-16T22:09:53.435167Z","times_seen":1779,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/images/email.png","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /images/email.png HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33165\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"email.png\"\r\ncontent-type: image/png\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"5f9a451c0ee0a4b114d11a7f45f73ca7\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:18 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::lvbfj-1762896063807-ea95387a26fe\r\ncontent-length: 4291\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":4291,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"5f9a451c0ee0a4b114d11a7f45f73ca7","sha1":"4da81d956c4d19982989ed2bc08124125eb5300d","sha256":"5e1f48eaf58c25ad902b150ed77f3d41937c137088c936c94184c92a99ea2af1","sha512":"3d509007929b3fc1de719a57d79182ac310ddd7618553b85a5cd3a75dabcdf0eecef432b942db65b08c92cad1da411fd5bd476474c3efabe11b99ad2b3f8ace1","ssdeep":"48:WmuBZ7QrJmR2SRZR5UvMU5QVQzxyQzwBcX2B0hXtxyxdSnce7hfyje0U6SGVUt6K:KQ1W2EmMU5QwJfmuzymT7hajnS16ZVq","tlshash":"3f9139671b84c4ca117a170c9b7963ee9f6ffdb3c0a92cd80554020ede6d8942207ee3","first_seen":"2025-11-11T16:02:29.600935Z","last_seen":"2025-11-12T22:44:02.011658Z","times_seen":7,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"api64.ipify.org/?format=json","fqdn":"api64.ipify.org","domain":"ipify.org","tld":"org"},"ip":{"addr":"104.237.62.213","port":443,"asn":18450,"as":"WEBNX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ipify.org","organization":""},"issuer":{"commonName":"RapidSSL TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 06 Feb 2025 00:00:00 GMT","end":"Mon, 09 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"9B:74:6A:25:D6:31:FF:C3:36:8D:D7:54:7C:C2:B6:CC:A3:CD:17:03","sha256":"FD:FB:ED:F7:BB:34:34:80:84:89:30:C9:CD:7E:D5:3D:1C:26:7F:A1:2F:28:2A:ED:F5:7F:C8:CD:8D:7E:5E:A7"}}},"request":{"raw":"GET /?format=json HTTP/1.1\r\nHost: api64.ipify.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/javascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://cache-owa-autodiscover-refreshv4.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 11 Nov 2025 21:21:04 GMT\r\nContent-Type: application/json\r\nContent-Length: 21\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7d69c71af0f191e9a72db6153f8018d1","sha1":"f67c5f2887bc05654b47f76e9621e53a4091aed1","sha256":"5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65","sha512":"fdf43a8f3d843fe9008949d6709c8e2a5cd640f6101522319745f0a829f21dc8f4bd4d70ff3e2f6e1fd53ca0d2dd872bf3588c593a403071102ab28763cbdba5","ssdeep":"","tlshash":"b8700022000000208c80800eca0a032223a0000ac20a00088e800b2288a0b380282032","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-06-07T07:51:18.251001Z","times_seen":93313,"resource_available":false,"data":null}},"time_used":1091,"timings":{"blocked":467,"dns":22,"connect":157,"send":0,"wait":157,"receive":0,"ssl":285},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-11T21:21:03.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33298\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"8adc24f8f360e7d714bc2a4d734276e6\"\r\nlast-modified: Tue, 11 Nov 2025 12:06:04 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zrjbt-1762896063244-6be83061df00\r\ncontent-length: 4190\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Webflow","description":"Webflow is Software-as-a-Service (SaaS) for website building and hosting.","website":"https://webflow.com","common_platform_enumeration":"","icon":"webflow.svg","categories":["Page builders","CMS"]},{"name":"jQuery:3.6.0","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":12304,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8adc24f8f360e7d714bc2a4d734276e6","sha1":"b518c255f64e99d9f5b14b77eb5626da844b3abf","sha256":"05dca6abaf00933e2cf901237be8a6a42dd20bf5587feca1e8f807aa246797d1","sha512":"bcfce60c80d5437a463dc1c0e96f2517f16da5a594407951f5dc8b9c0791ec6c3927e1fbe21536968b22d2daa9a9178e38eeaded0a8b7f97804d89fc03bf66b4","ssdeep":"192:iaAYp83KmOSxlgre0oW/8ssEV/xf+r7heZqMzDLv:iaBpYKmPsBRx2Kq2","tlshash":"3242858b75f311a13aa350b1a77bb1043277e00f6c05c848799dc7286f49e5aaa677ce","first_seen":"2025-11-11T16:02:29.594367Z","last_seen":"2025-11-12T10:32:18.954159Z","times_seen":4,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":41,"dns":20,"connect":1,"send":0,"wait":10,"receive":28,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2025-11-11","alert":"Detects file containing Telegram Bot API","trigger":"cache-owa-autodiscover-refreshv4.vercel.app/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/css/outlook-469662.webflow.css","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /css/outlook-469662.webflow.css HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33166\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"outlook-469662.webflow.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"72bdd11f3d04643111ad25c9056314b5\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:17 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::5pgn7-1762896063445-d71a5c687401\r\ncontent-length: 729\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2178,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"b812797d297c344d87c3b08a027ef068","sha1":"04876c93d5c19a7d29224a3d8f497881a799ebf8","sha256":"7a55ba3394f4fe00b44ffe9a8392e98208ceacf0c381518c5e20cf13bd588e2e","sha512":"5ab738eb15a2c5bbef8770877c9fa721739228e068de6a128bd4bbd5bd75db65136fdf2089f50d8559151d3aee1a87557efba017cde1e11df6e563f511a44a81","ssdeep":"","tlshash":"794123d34a710a0c750af49d6d75950473994082db0fdad57ac0284defcd2ca6c36bc9","first_seen":"2025-11-11T16:02:29.595314Z","last_seen":"2025-11-12T22:44:02.010845Z","times_seen":7,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-3.6.0.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-3.6.0.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-15d9d\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\nage: 2522781\r\nx-served-by: cache-lga21931-LGA, cache-hel1410029-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 71, 572111\r\nx-timer: S1762896064.630647,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 30875\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]}],"data":{"size":89501,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"8fb8fee4fcc3cc86ff6c724154c49c42","sha1":"b82d238d4e31fdf618bae8ac11a6c812c03dd0d4","sha256":"ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e","sha512":"f3de1813a4160f9239f4781938645e1589b876759cd50b7936dbd849a35c38ffaed53f6a61dbdd8a1cf43cf4a28aa9fffbfddeec9a3811a1bb4ee6df58652b31","ssdeep":"1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn","tlshash":"069309ddb2c6702257a720ba007f510bf236199d6c4d8450f169d8eabc78a4e827bf7d","first_seen":"2023-03-07T01:02:13Z","last_seen":"2026-08-16T21:46:41.326465Z","times_seen":498523,"resource_available":true,"data":null}},"time_used":368,"timings":{"blocked":163,"dns":19,"connect":26,"send":0,"wait":26,"receive":10,"ssl":118},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/js/webflow.js","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /js/webflow.js HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33166\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"webflow.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"79b0a6a2156121ac9cf29ca176876084\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:17 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::nwdr7-1762896063448-7b7902d514de\r\ncontent-length: 15342\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":41716,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (41716), with no line terminators","md5":"3cba4fe138cdf0a533a9133762974504","sha1":"b9a99489f727cb71dbc6b432e2fc2762452c7141","sha256":"eda310cbf970ff74be6656156df5b4c7379e7e125b1a997b925058176fac841a","sha512":"bfc6d6e1c029b585a154d4b69c997a194cc75e5d96e3068dd3ab0e160f8dd6e664774580b8ca9cd24b84b2f9321f3ed2f11661eca93f4e1cb5d169ac5c858ee8","ssdeep":"768:eimnVBXOPE29VhZjEM37KbRW5erJVBlv26+tvCvTd9fKV5f8b1Sr6zFT4F7kz6:KnVBXOP9W9B7vTd9fvhg5","tlshash":"8b13d5ceb285b4b613d362f0905f9309623b5555744a484cf23ad8e57e78d8ca12bfbc","first_seen":"2025-11-10T13:01:06.818655Z","last_seen":"2026-06-13T05:06:19.39163Z","times_seen":11,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.prod.website-files.com/68f89e5e044f107c8074cdb5/68f8b899298663920f95c938_157bece9-7026-47eb-bbff-eae4174424f0-2.png","fqdn":"cdn.prod.website-files.com","domain":"website-files.com","tld":"com"},"ip":{"addr":"104.18.161.117","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.801Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"prod.website-files.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Oct 2025 20:20:26 GMT","end":"Thu, 08 Jan 2026 21:20:23 GMT"},"fingerprint":{"sha1":"36:73:72:40:FB:41:28:BD:49:77:FB:90:5B:2E:02:FA:18:98:46:F3","sha256":"9A:F2:2E:A6:DB:A5:41:83:DC:C8:50:D9:A2:A6:B3:44:A8:AC:3F:1E:23:9C:EA:65:A2:FF:1F:93:59:1D:E2:FC"}}},"request":{"raw":"GET /68f89e5e044f107c8074cdb5/68f8b899298663920f95c938_157bece9-7026-47eb-bbff-eae4174424f0-2.png HTTP/1.1\r\nHost: cdn.prod.website-files.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 454\r\ncf-ray: 99d0d64f1ae9c759-OSL\r\nx-amz-id-2: PUhfX+Hb0HmqVUdRP1mE1WsOiFKSUw1Kc5Yaj7O+vULdnTncsVpn0jS1slICAF58uCB9n7LJvjM=\r\nx-amz-request-id: 5AFNQ8VBV55928MD\r\nlast-modified: Wed, 22 Oct 2025 10:57:31 GMT\r\netag: \"0789552787bc47afbcffe31ddca2c3e2\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: max-age=31536000, must-revalidate\r\nx-amz-version-id: TnjwhuOvISPNFC3qTUvO74SQC0Gedz6E\r\ncf-cache-status: HIT\r\nage: 46323\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":454,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","md5":"0789552787bc47afbcffe31ddca2c3e2","sha1":"6a2ec3f9e415c47275fdbb434f9e12cb60642d59","sha256":"4cbc854a094d90e4768db969fe982da85faf57f4132c71279e4fd0a81a378e2d","sha512":"76df4eb4c7d72a6934011c6e0c174c2946280296756b8c2951a54509b988e324ce0bf28ec06b07feb216a37c767f3d5bce447b8743f4d8c3a1150921c0c5511b","ssdeep":"","tlshash":"abf0d45f0173c8e78f055b752929b503a8163526ddcd43750b5184792d1002ed9d1c4e","first_seen":"2025-11-11T16:02:29.59235Z","last_seen":"2025-11-12T22:44:01.999266Z","times_seen":7,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":33,"connect":1,"send":0,"wait":15,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cache-owa-autodiscover-refreshv4.vercel.app/images/outlook-logo-png_seeklogo-299920.png","fqdn":"cache-owa-autodiscover-refreshv4.vercel.app","domain":"cache-owa-autodiscover-refreshv4.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://cache-owa-autodiscover-refreshv4.vercel.app/","date":"2025-11-11T21:21:03.814Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 25 Oct 2025 22:29:14 GMT","end":"Fri, 23 Jan 2026 22:29:13 GMT"},"fingerprint":{"sha1":"6B:2C:E8:1D:DD:60:8E:79:54:CE:FA:CD:72:7F:4D:C0:7B:8E:6F:6B","sha256":"EF:F6:2B:04:2D:F4:71:55:1C:CA:FF:E3:7C:C9:DA:AB:BB:2E:C1:D2:5F:62:C5:3A:A8:D0:FC:85:01:D3:0D:1F"}}},"request":{"raw":"GET /images/outlook-logo-png_seeklogo-299920.png HTTP/1.1\r\nHost: cache-owa-autodiscover-refreshv4.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cache-owa-autodiscover-refreshv4.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 33165\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"outlook-logo-png_seeklogo-299920.png\"\r\ncontent-type: image/png\r\ndate: Tue, 11 Nov 2025 21:21:03 GMT\r\netag: \"2fc55ac36211fb6b5a051281cc4898ad\"\r\nlast-modified: Tue, 11 Nov 2025 12:08:18 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::pnj2m-1762896063808-26aaeec6a54f\r\ncontent-length: 1441\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":1441,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"2fc55ac36211fb6b5a051281cc4898ad","sha1":"5e2b2882d0bdbe593429a43de72ee3c3652e62ce","sha256":"07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7","sha512":"49dbb218b01f6aae602facee3ccfa01180607c17e6ba0cf5ec5c269da0ef4574cfda15309af115416d70a7bc9b6d70269286f8f52ccca8326e27b150b108f4ae","ssdeep":"","tlshash":"3c215487ff88784053ade39234b79027d9220b559ed4f47ab9cec01e59341b5181f6cb","first_seen":"2023-05-04T02:09:13Z","last_seen":"2026-08-08T12:31:29.112089Z","times_seen":622,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-11-11","alert":"Phishing Block","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-11","alert":"Sinkholed","trigger":"cache-owa-autodiscover-refreshv4.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}