{"report_id":"7785a727-e7a2-4627-a0f4-836d049ac6cf","version":6,"status":"done","tags":[],"date":"2026-04-02T03:20:28Z","url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"3.5.129.21","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"title":"Sign in - Professional Email","dom":{"size":44,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"73956d6ebea072659493bd6a2b58c593","sha1":"729b2f4da55d3b13b793a00fa20bc8ec10c63ed0","sha256":"7b8dc4dc541347fb74e4933dd718adb981e124bae2cded37d903791df90aafb3","sha512":"bac2a7efaaf047493b9f0d095fc259a63b44c9b6312684b01b99d709920138f7cb268a4513a6f10444c3ec14bf1f2347005dd95b00939fc1cc259a0a0dc7b4a6","ssdeep":"","tlshash":"109004fdd4d1100d5c7035d00cc113d10c14437430114f00ddc1747cd405115dc031d4","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"3.5.129.21","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-07T03:20:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"Client IP","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.92.57","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.414533+0000\",\"flow_id\":131863555905681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.92.57\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":40888,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":33,\"bytes_toserver\":1767,\"bytes_toclient\":43639,\"start\":\"2026-04-02T03:20:08.956561+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"Client IP","port":37794,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.907891+0000\",\"flow_id\":87973285138007,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.88.25\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":37794,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":34,\"bytes_toserver\":1953,\"bytes_toclient\":43705,\"start\":\"2026-04-02T03:20:09.331351+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-02","alert":"Phishing Block","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","ip":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2026-02-16T15:07:33.983556Z","last_seen":"2026-03-07T10:32:56.925222Z","alert_count":10,"request_count":2,"received_data":41449,"sent_data":938,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"waxmedx.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2024-12-20","domain_rank":0,"first_seen":"2025-01-21T12:01:20.324563Z","last_seen":"2026-03-17T23:49:21.672092Z","alert_count":0,"request_count":5,"received_data":0,"sent_data":2425,"comment":"","tags":null,"fingerprints":null},{"fqdn":"webmail-oxcs.networksolutionsemail.com","ip":{"addr":"198.251.71.220","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"domain_registered":"2003-01-09","domain_rank":671255,"first_seen":"2021-11-09T02:11:21Z","last_seen":"2026-03-28T12:37:12.806365Z","alert_count":0,"request_count":1,"received_data":462,"sent_data":513,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"javascriptURL","is_inline":false,"md5":"68934a3e9455fa72420237eb05902327","sha1":"7cb6efb98ba5972a9b5090dc2e517fe14d12cb04","sha256":"fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa","sha512":"719fa67eef49c4b2a2b83f0c62bddd88c106aaadb7e21ae057c8802b700e36f81fe3f144812d8b05d66dc663d908b25645e153262cf6d457aa34e684af9e328d","ssdeep":"","tlshash":"aa3000000000000c000000000000000000000000000000000000000030000000000000","size":5,"data":"","first_seen":"2023-03-07T01:02:06Z","last_seen":"2026-07-27T09:40:01.93359Z","times_seen":79824,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9aa5acf0809feec17f49c5a767e77109","sha1":"2b442beae58032fd108164a458f410ab26f508a6","sha256":"d9682ed531e3afbd53399c4236ebba63fb82aa0c858d460751f7e303024696bb","sha512":"363d10f59b3418aa44120013525f09d704218429fbe5eb1905c7d2dedb2569dc275ec838c9b67e7104ab388037e19e3a30b91ff8c917be41dd22ea0cd8212876","ssdeep":"","tlshash":"d2c012ca4d46144642d22312598330641472d1ff1398a40779586e012b6975c1a16b84","size":179,"data":"","first_seen":"2023-03-14T05:05:51Z","last_seen":"2026-06-06T10:10:38.717303Z","times_seen":3154,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.92.57","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.414533+0000\",\"flow_id\":131863555905681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.92.57\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":40888,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":33,\"bytes_toserver\":1767,\"bytes_toclient\":43639,\"start\":\"2026-04-02T03:20:08.956561+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":37794,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.907891+0000\",\"flow_id\":87973285138007,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.88.25\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":37794,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":34,\"bytes_toserver\":1953,\"bytes_toclient\":43705,\"start\":\"2026-04-02T03:20:09.331351+0000\"}}"}],"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6cebe24ff4f67f2767d2a729d0cbee00","sha1":"eaf56acf9d514778119d762cfa521c94c2b7e884","sha256":"56428f4061d871e5c97880100e5b9bec42219947248326dc9f62ff14cfc74335","sha512":"c9ab1baac60b514535066cd885e7e58dea9ad2b30925676b18b74f58f39ad43c840f67c5d417cae9d42758108a7b43ce0f8567af37bb132d7e5e2963f79a86f7","ssdeep":"","tlshash":"8811122d59766838651346f3319526c325034c1f9c44337b75af53042f9948df2b6afa","size":856,"data":"","first_seen":"2024-01-11T05:06:02Z","last_seen":"2026-06-06T10:10:38.717882Z","times_seen":593,"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.92.57","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.414533+0000\",\"flow_id\":131863555905681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.92.57\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":40888,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":33,\"bytes_toserver\":1767,\"bytes_toclient\":43639,\"start\":\"2026-04-02T03:20:08.956561+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":37794,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.907891+0000\",\"flow_id\":87973285138007,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.88.25\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":37794,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":34,\"bytes_toserver\":1953,\"bytes_toclient\":43705,\"start\":\"2026-04-02T03:20:09.331351+0000\"}}"}],"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"http","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-02T03:20:09.331Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: net-wok.s3-website.us-east-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: ygMFuR8GAV2npw2Sk04WQYDoZNcbTi+Kifkqoem+tHOj/DhmBrQ7NjcQRg8kGlpbo8pNq+nUq7VMSR3XVq6wGf53qx9Iou/b\r\nx-amz-request-id: GPNGGPFKFB5BC5FW\r\nDate: Thu, 02 Apr 2026 03:20:10 GMT\r\nLast-Modified: Sat, 15 Mar 2025 13:49:27 GMT\r\nETag: \"d1589403c5c03be635a87ae4aeab7703\"\r\nContent-Type: text/html\r\nContent-Length: 41093\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":41093,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"28b7c745d41be1bdd8e00b95585f71d5","sha1":"78b403fadbb54795177784b587d646f0bfeb5b9c","sha256":"a897c101bacf19d20c213d169902aff7893e6b94cd2282a0a2e9fb542cabec8f","sha512":"51f84ca551cd16b4b294da63bfe73149f8a2fe22fe7258c04a874e9109403ae66bad61ccc5fadfff50a3b6616d30fbc2f9967eff1826f3d20599f3eb8c93225b","ssdeep":"384:jle0uvbY0bcbuDBm/Zm08OVBYj3oAsCrUflu/egEUCL8G8+b8bityZl8MTzZuvu4:WEaj3oAsCrK5bZMCV5NJj","tlshash":"b303866aa4b5145653170ec437d1a6243942e00f8c8bf9dc76be82d85fe0e936c9f78e","first_seen":"2026-04-02T03:20:29.778937Z","last_seen":"2026-04-02T03:20:29.778937Z","times_seen":1,"resource_available":false,"data":null}},"time_used":574,"timings":{"blocked":110,"dns":1,"connect":109,"send":0,"wait":136,"receive":218,"ssl":0},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.92.57","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.414533+0000\",\"flow_id\":131863555905681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.92.57\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":40888,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":33,\"bytes_toserver\":1767,\"bytes_toclient\":43639,\"start\":\"2026-04-02T03:20:08.956561+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":37794,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.907891+0000\",\"flow_id\":87973285138007,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.88.25\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":37794,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":34,\"bytes_toserver\":1953,\"bytes_toclient\":43705,\"start\":\"2026-04-02T03:20:09.331351+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-02","alert":"Phishing Block","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"waxmedx.com/new/network/media/index.html.js.download","fqdn":"waxmedx.com","domain":"waxmedx.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.668Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /new/network/media/index.html.js.download HTTP/1.1\r\nHost: waxmedx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: http://net-wok.s3-website.us-east-2.amazonaws.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waxmedx.com/new/network/media/main-781bf877.css","fqdn":"waxmedx.com","domain":"waxmedx.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.670Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /new/network/media/main-781bf877.css HTTP/1.1\r\nHost: waxmedx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waxmedx.com/new/network/media/logo","fqdn":"waxmedx.com","domain":"waxmedx.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.694Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /new/network/media/logo HTTP/1.1\r\nHost: waxmedx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"waxmedx.com/new/network/media/error-generic.svg","fqdn":"waxmedx.com","domain":"waxmedx.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.692Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /new/network/media/error-generic.svg HTTP/1.1\r\nHost: waxmedx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webmail-oxcs.networksolutionsemail.com/appsuite/favicon.svg?version=3999779421","fqdn":"webmail-oxcs.networksolutionsemail.com","domain":"networksolutionsemail.com","tld":"com"},"ip":{"addr":"198.251.71.220","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.networksolutionsemail.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Mon, 22 Dec 2025 00:00:00 GMT","end":"Tue, 22 Dec 2026 23:59:59 GMT"},"fingerprint":{"sha1":"4A:D4:DA:57:B4:2E:66:EA:E2:1F:CB:8A:DB:C6:1A:27:BD:B0:FE:E6","sha256":"29:D0:EA:9F:32:0D:4B:2C:84:1E:A6:4A:49:37:B0:79:FD:16:CC:C2:88:1F:27:E0:9A:A7:2F:70:75:31:4B:F4"}}},"request":{"raw":"GET /appsuite/favicon.svg?version=3999779421 HTTP/1.1\r\nHost: webmail-oxcs.networksolutionsemail.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ndate: Thu, 02 Apr 2026 03:20:11 GMT\r\ncontent-type: application/xml\r\nx-amz-request-id: tx00000469141b9baa03b19-0069cde06b-1755bceff-msc1\r\nx-app-server: rgw14ham2\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload;\r\nx-content-type-options: nosniff\r\nx-download-options: noopen\r\nx-permitted-cross-domain-policies: none\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":1808,"timings":{"blocked":-1,"dns":47,"connect":118,"send":0,"wait":1460,"receive":0,"ssl":183},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"net-wok.s3-website.us-east-2.amazonaws.com/","fqdn":"net-wok.s3-website.us-east-2.amazonaws.com","domain":"net-wok.s3-website.us-east-2.amazonaws.com","tld":"s3-website.us-east-2.amazonaws.com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-02T03:20:05.969Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: net-wok.s3-website.us-east-2.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":51,"connect":109,"send":0,"wait":0,"receive":0,"ssl":-1},"alerts":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":40888,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.92.57","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.414533+0000\",\"flow_id\":131863555905681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.92.57\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":40888,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":22,\"pkts_toclient\":33,\"bytes_toserver\":1767,\"bytes_toclient\":43639,\"start\":\"2026-04-02T03:20:08.956561+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-02T03:20:19Z","timestamp":1775100019,"ip_dst":{"addr":"172.18.0.19","port":37794,"asn":0,"as":"","country":"","country_code":"zz"},"ip_src":{"addr":"3.5.88.25","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"severity":"medium","alert":"ET PHISHING Possible Phish - Saved Website Comment Observed","source":"{\"timestamp\":\"2026-04-02T03:20:19.907891+0000\",\"flow_id\":87973285138007,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"3.5.88.25\",\"src_port\":80,\"dest_ip\":\"172.18.0.19\",\"dest_port\":37794,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2018334,\"rev\":3,\"signature\":\"ET PHISHING Possible Phish - Saved Website Comment Observed\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"Low\"],\"created_at\":[\"2014_03_31\"],\"deployment\":[\"Perimeter\"],\"mitre_tactic_id\":[\"TA0001\"],\"mitre_tactic_name\":[\"Initial_Access\"],\"mitre_technique_id\":[\"T1566\"],\"mitre_technique_name\":[\"Phishing\"],\"signature_severity\":[\"Minor\"],\"tag\":[\"Phishing\"],\"updated_at\":[\"2023_12_19\"]}},\"http\":{\"hostname\":\"net-wok.s3-website.us-east-2.amazonaws.com\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":200,\"length\":41093},\"files\":[{\"filename\":\"/\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":41093,\"tx_id\":0}],\"app_proto\":\"http\",\"flow\":{\"pkts_toserver\":23,\"pkts_toclient\":34,\"bytes_toserver\":1953,\"bytes_toclient\":43705,\"start\":\"2026-04-02T03:20:09.331351+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-04-02","alert":"Phishing Block","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-04-02","alert":"Sinkholed","trigger":"net-wok.s3-website.us-east-2.amazonaws.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"waxmedx.com/new/network/media/logo_180.png","fqdn":"waxmedx.com","domain":"waxmedx.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://net-wok.s3-website.us-east-2.amazonaws.com/","date":"2026-04-02T03:20:09.827Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /new/network/media/logo_180.png HTTP/1.1\r\nHost: waxmedx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: http://net-wok.s3-website.us-east-2.amazonaws.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-27T10:26:15.180389Z","times_seen":17561103,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}