{"report_id":"862200d6-bb8d-4966-b205-2c9894dbb8e0","version":0,"status":"done","tags":[],"date":"2026-10-06T21:49:29Z","url":{"schema":"https","addr":"vodafone-form.mhmr.ro/","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":0,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"title":"Vara asta, eşti ȋn câştig cu Vodafone","dom":{"size":16203,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (346)","md5":"6c9571cfc1dd3d13b3e8a11c0707ec36","sha1":"7957953280e1c07c3e82d8e27d66be4abf47f7a2","sha256":"cd4f4eb9026186bf12c0f1b6096d366762592452fd0fe454e2f0a9f25c6f1e4c","sha512":"c99957fd155de2b74a72539139c0fa1184577cb0e9e7883ffbe05b79bef990c859c979ba1efad5f788be24a8a33904ace64f43c581b5605e15f94e9de6f6c28d","ssdeep":"192:XAulgopGDfVWQ9rZJQCEdP/Sd6yGCFYO6WUcI8I:XA/osDNWQBZJQCSPKd6ytFppJI","tlshash":"65721c7164f40973819b88d5a5b45e0abee1db03ca1b4588b6ec0fd06fdbc47ce17698","dom_hash":"domhash0bfedc718150956f6706a9c669da7dda","first_seen":"2026-10-06T21:20:10.642189Z","last_seen":"2026-10-06T21:49:56.599042Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":0,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-10T21:49:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"vodafone-form.mhmr.ro","ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"domain_registered":"2009-06-25","domain_rank":0,"first_seen":"2025-11-28T01:46:53.512643Z","last_seen":"2026-10-06T21:20:04.413323Z","alert_count":39,"request_count":13,"received_data":5579175,"sent_data":6479,"comment":"","tags":null,"fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"MDBootstrap","description":"MDBootstrap (Material Design for Bootstrap) is a complete UI package that can be integrated with other frameworks such as Angular, React, Vue, etc. It is used to design a fully responsive and mobile-friendly layout using various components, plugins, animation.","website":"https://mdbootstrap.com","common_platform_enumeration":"","icon":"MDBootstrap.png","categories":["UI frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-10-04T22:47:16.540786Z","alert_count":0,"request_count":1,"received_data":8392,"sent_data":542,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-10-04T23:38:02.393941Z","alert_count":0,"request_count":1,"received_data":90229,"sent_data":530,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/js/mdb.min.js","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"669b593c9db3ceedfb5357b56bb2d9b7","sha1":"6bc797081be17a521170993d5bdfc707c4c51721","sha256":"6c0269ab7a605800ceca5e557f8549e6e512a401a96304f539fd898f3f19e3d8","sha512":"c8d605710fec726aa9d3d3ebe2f696fc10164dc6013e1d2998f5886198220a5d6893f37197d9cc9b9842700f98ef9c9a84195e185c755f003d99cf2992036469","ssdeep":"12288:ReWVS2VkhBEsTQd3lyPcZk9i5+w0j00E5ZGbcZjFJaWeKeUcEbroQZJ:ReHvHEkQ5m9iogthHeKeUcEbrog","tlshash":"bde4f7453251b47302db81ea403b470bf236a9656407886cb5bdddde2b7cc8672bbb39","size":717267,"data":"","first_seen":"2025-10-28T23:31:15.839347Z","last_seen":"2026-10-06T21:49:56.603274Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/plugins/js/all.min.js","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"a5933b76690d44cddbbdb3e2b556d950","sha1":"643bfd8670426bbfd70f5ec7bd4898227847b0b0","sha256":"5f78a6854ce126f6d5cad1117865cb4aa5106f3b1c69c359b61c215aff4e3b2a","sha512":"349e013b97039108a067b79cbdf58b0a38e305847c0c06163384b1ebcc77fee6899db2426ba5debc75e73965fb94157bbd68d3a5eaf841440cb8895a215efbac","ssdeep":"12288:gyAfpJb/0rtOOsaBLyWMQing9yTyt/3YKGWerRJfXwF8+YVc:gLpJzq8WLymig9yTZRJ9c","tlshash":"a2e545d9a3d4d0f07add2174d53b058b7225a4b6a8c4d8c8a32efc84d876ec9772de18","size":3294607,"data":"","first_seen":"2025-11-07T03:59:52.621187Z","last_seen":"2026-10-06T21:49:56.618009Z","times_seen":13,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/js/mainScript.js?v=01072026001","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"08d55a9d8016b10610005b2165e19ae8","sha1":"5dbcc4a936e60f4eda4610c0af4965b5d9586a0e","sha256":"883afbe09f03d19069331fa542e2326da285b9668ae52d9650f985b667e6dbc7","sha512":"a57a05e6c7cfb6be98d5c859ba62fecb266a1f8a28c3c16dcc411b05cb14fafdd5f8d38ac934b916d64e2ccb1705ec4d55b9fae5e25435f14416dd158cbae98f","ssdeep":"96:oQLF4zedtlnfcpL9FEHFa/Sc9zKaaDMbcKIsHxrKwuS7KBXKYoSRV6C3f23t1LvT:Tvdt49aDMbB0+3NIzBp7wgm","tlshash":"4062e14b7a1d09714e7a727bdf278994fe39093718449658b89c82451f308d8c1fbfb9","size":15669,"data":"","first_seen":"2026-10-06T21:20:10.658642Z","last_seen":"2026-10-06T21:49:56.605385Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-06T21:48:07.782Z","timestamp":1791323287782,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 01 Jul 2026 12:56:37 GMT\r\netag: W/\"3bd3-6558c38cceb40\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"MDBootstrap","description":"MDBootstrap (Material Design for Bootstrap) is a complete UI package that can be integrated with other frameworks such as Angular, React, Vue, etc. It is used to design a fully responsive and mobile-friendly layout using various components, plugins, animation.","website":"https://mdbootstrap.com","common_platform_enumeration":"","icon":"MDBootstrap.png","categories":["UI frameworks"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}],"data":{"size":15315,"size_decoded":3196,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (346), with CRLF, LF line terminators","md5":"8a98e49eb457585e01efa0f26657fd3a","sha1":"c8907783a8fd60a71c5b40d8783ea81c48fad4a8","sha256":"fc93c20feb0e210a9c58a6312411ec42d1200c6de98a541586975a3b96397877","sha512":"92907589267aec8acabe930fddc92082ccec0195483a8e5434990569acbf1c70bf081b28f11019d9a599b7b21c2efbffd5212ac21e89230b2eb787820c4570a6","ssdeep":"192:WBixCoJaqP2kS6+pq+qFrCs3CvXCyM+nTYcnFWUAnKi:WBboYqekShw+kmI3yVTLQAi","tlshash":"ba62fc2024c4093381bb85daa9b55f5afea08343cb1b9688b6ec2bd71ff7c16cd17254","first_seen":"2026-10-06T21:20:10.688148Z","last_seen":"2026-10-06T21:49:56.600583Z","times_seen":2,"resource_available":true,"data":null}},"time_used":648,"timings":{"blocked":-1,"dns":64,"connect":54,"send":0,"wait":108,"receive":0,"ssl":422},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@300;400;500;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.42","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.836Z","timestamp":1791323288836,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 18 Sep 2026 20:01:49 GMT","end":"Fri, 11 Dec 2026 20:01:48 GMT"},"fingerprint":{"sha1":"E3:3D:17:9C:78:F1:DE:68:C7:E6:BB:8F:08:DC:78:F3:9D:DF:F2:43","sha256":"EB:D6:1D:9A:76:0B:5A:3C:08:74:83:6D:AA:A7:F4:B3:0D:17:8F:4F:3E:6B:9C:91:6C:5B:9E:F7:08:1F:00:62"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@300;400;500;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 06 Oct 2026 21:48:08 GMT\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7708,"size_decoded":1341,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"eee4eb1e7e91ad20c727808a32f501fd","sha1":"901aa6b02d419e85cca3090c92db60fc501ee2e1","sha256":"cf6cdb36926a175d6f7652f527ab0a40674852a6f1ec70539c01f882f42e721c","sha512":"837e6da4bf8846f086548b85b1a37c5c64b5839f4e6fb8042ed6e9ebd921b5b888f53c880eea735f221e29cc9b445225b530ff99c60010d0a09dd5c45cb547a8","ssdeep":"192:FRV7y6OjuXRo7TbOCuwRv7M0Oxu6RB7W+Ofu8:zRrQ7Tudi","tlshash":"8ff1cf911057e500e6472cc923cf7e26dd4e216274a4c5797ffe2ca8adeac260325b3d","first_seen":"2026-10-05T23:43:53.331199Z","last_seen":"2026-10-12T21:00:23.712949Z","times_seen":13,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":3,"connect":16,"send":0,"wait":34,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/plugins/css/all.min.css?v=100","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.839Z","timestamp":1791323288839,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /plugins/css/all.min.css?v=100 HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Feb 2023 14:55:18 GMT\r\netag: W/\"8d6e-5f57351532180\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36206,"size_decoded":6695,"mime_type":"text/css","magic":"ASCII text, with very long lines (8849)","md5":"47cd876630fc9bc50eb976475eb6e5d8","sha1":"949a96a305cfa12a9b01238030e684049e7b96ed","sha256":"28b0658cfae6e6ef4388f0f01de98fc741edf993f0050e3ddae53126fe7e6c80","sha512":"035648dda2eddbc359215480ae6eeef9c1881dd32777638484b3a02320b0a983eeb4412577398f8415cfecd55d86c06ab9ab360e0409c94babe45b6f48719ace","ssdeep":"192:Zc/3sddcYqaL55vnlKxHIk7H5f2hn3InjWyW3xoxN8vrXnfCIHICzhzQUBaGht1K:Zc/3sdddqs59nlWH2jOGReA8f","tlshash":"09f2b42be64036257417ce2a52c446c7963de1b5f9322bfcb9166e048fcb58207a3e5f","first_seen":"2025-11-07T03:59:52.603698Z","last_seen":"2026-10-06T21:49:56.602539Z","times_seen":13,"resource_available":true,"data":null}},"time_used":136,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/js/mdb.min.js","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.843Z","timestamp":1791323288843,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /js/mdb.min.js HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Feb 2023 14:55:18 GMT\r\netag: W/\"af1d3-5f57351532180\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":717267,"size_decoded":187711,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (36429), with LF, NEL line terminators","md5":"669b593c9db3ceedfb5357b56bb2d9b7","sha1":"6bc797081be17a521170993d5bdfc707c4c51721","sha256":"6c0269ab7a605800ceca5e557f8549e6e512a401a96304f539fd898f3f19e3d8","sha512":"c8d605710fec726aa9d3d3ebe2f696fc10164dc6013e1d2998f5886198220a5d6893f37197d9cc9b9842700f98ef9c9a84195e185c755f003d99cf2992036469","ssdeep":"12288:ReWVS2VkhBEsTQd3lyPcZk9i5+w0j00E5ZGbcZjFJaWeKeUcEbroQZJ:ReHvHEkQ5m9iogthHeKeUcEbrog","tlshash":"bde4f7453251b47302db81ea403b470bf236a9656407886cb5bdddde2b7cc8672bbb39","first_seen":"2025-10-28T23:31:15.839347Z","last_seen":"2026-10-06T21:49:56.603274Z","times_seen":12,"resource_available":true,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/img/loading-spinner.gif","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.856Z","timestamp":1791323288856,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /img/loading-spinner.gif HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:09 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 17 Jun 2024 06:49:11 GMT\r\netag: W/\"328-61b105cd91581\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":808,"size_decoded":643,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"a943672a32297727bab01c3e76977550","sha1":"3a667c4b7a457ef6c586cc581d533c128737bf53","sha256":"b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187","sha512":"0965d415f3a0cef31953702fdae345d46fefd72ce3c4c7a0255aede74a76e10b856892700529a444453a622793e0257248c5c99fae17d5b0b9fd4118e208068c","ssdeep":"","tlshash":"2e01bd0a08e0501bc0d3915169a0f22dc9c2f997aa5b180079ed91c6cfd5f89c9d35ac","first_seen":"2023-03-08T11:42:06Z","last_seen":"2026-10-13T02:06:36.017351Z","times_seen":39630,"resource_available":true,"data":null}},"time_used":717,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":717,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/js/mainScript.js?v=01072026001","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.846Z","timestamp":1791323288846,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /js/mainScript.js?v=01072026001 HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 17 Jun 2026 08:42:57 GMT\r\netag: W/\"3d39-6546f0bd6e640\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15673,"size_decoded":2784,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"08d55a9d8016b10610005b2165e19ae8","sha1":"5dbcc4a936e60f4eda4610c0af4965b5d9586a0e","sha256":"883afbe09f03d19069331fa542e2326da285b9668ae52d9650f985b667e6dbc7","sha512":"a57a05e6c7cfb6be98d5c859ba62fecb266a1f8a28c3c16dcc411b05cb14fafdd5f8d38ac934b916d64e2ccb1705ec4d55b9fae5e25435f14416dd158cbae98f","ssdeep":"96:oQLF4zedtlnfcpL9FEHFa/Sc9zKaaDMbcKIsHxrKwuS7KBXKYoSRV6C3f23t1LvT:Tvdt49aDMbB0+3NIzBp7wgm","tlshash":"4062e14b7a1d09714e7a727bdf278994fe39093718449658b89c82451f308d8c1fbfb9","first_seen":"2026-10-06T21:20:10.658642Z","last_seen":"2026-10-06T21:49:56.605385Z","times_seen":2,"resource_available":true,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/img/logo_vodafone.svg","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.852Z","timestamp":1791323288852,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /img/logo_vodafone.svg HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:09 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 614\r\nlast-modified: Mon, 13 May 2024 09:01:54 GMT\r\netag: \"266-6185223024480\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":614,"size_decoded":934,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"98341839ea48fd2aa442450db32a873d","sha1":"8420e95068fca2142b1d17850bd38ffd8ce34209","sha256":"5e49559adfc27776dbc1308a53fee6b3e02bee6c0abe65ac07318beb6d937a46","sha512":"b1aecb25840a8dc07cad50f0f4b96aeab1d9c7bb01acb1a378be58db24a33a78cc7272851be190686972ec977ab76cc725874362859c5036a3627985c4b74fbd","ssdeep":"","tlshash":"7ff00c9952095f9cd443038caae4f0907691e0ee324c63f913c228713cc3bf234119a8","first_seen":"2023-09-05T15:08:53Z","last_seen":"2026-10-06T21:49:56.606205Z","times_seen":17,"resource_available":false,"data":null}},"time_used":2359,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":721,"receive":1638,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/img/logo-zoom-beach.png","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.853Z","timestamp":1791323288853,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /img/logo-zoom-beach.png HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 53659\r\nlast-modified: Tue, 18 Jun 2024 14:22:33 GMT\r\netag: \"d19b-61b2ad0079c40\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":53659,"size_decoded":53978,"mime_type":"image/png","magic":"PNG image data, 1316 x 501, 8-bit/color RGBA, non-interlaced","md5":"02cb7280be4b609503974bd71543f567","sha1":"d95723dec570f7ad2ddff7a7f4f012e6f0561276","sha256":"0022e140da40dbbf822234d3ee14c4348836466360c7b440ef9155f6160ea3a7","sha512":"dce84fbbc5498fcc8d7fa58bd0204b3bdb9dccb0afb8bc180bb0219e1023c986d07f2066cef72bbc8b842874361a43314741babde379c2313c47d23489719218","ssdeep":"1536:SOyRnQPexv3NQQGa7rdIELqV960tZGUEnI+:SF7rdIEwttZGN","tlshash":"4233029769bf7169ddcf097a85d0e9c22222421a7a9b4bc3ff4c40bd8b00765a717e07","first_seen":"2026-10-06T21:20:10.677693Z","last_seen":"2026-10-06T21:49:56.607041Z","times_seen":2,"resource_available":false,"data":null}},"time_used":3061,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":719,"receive":2342,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/img/favicon.ico","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:12.520Z","timestamp":1791323292520,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /img/favicon.ico HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:12 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 19104\r\nlast-modified: Mon, 13 May 2024 08:59:08 GMT\r\netag: \"4aa0-61852191d4f00\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19104,"size_decoded":19438,"mime_type":"image/vnd.microsoft.icon","magic":"PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced","md5":"9781a2b7bf51f2786777e90abb86470c","sha1":"12fd0d3b4a51cb7df8d04e1c2a5eddfc80cf1406","sha256":"e6d14973410e6122b34fecc8336cda7a018578b32380532b129c4bd67277fa4a","sha512":"7489d2c2c364b400bc818e278c9914e00b274adccd786f66007a49b509410df5898e500347fab85deda69152c01d3388a9a295c9ff2fb1dc8fa70fd7b85e9064","ssdeep":"96:XZ/I09Da01l+gmkyTt6Hk8nTMkEWR3xNXrNXrTz0YqcVonD7J9pp4TeJQ4c8:XS0tKg9E05TMktB59z0Vx9pdS8","tlshash":"86822834fcf0715958c9f6316ec424026e770b87c9826c84bade4d9b6f10f9a8e9f196","first_seen":"2023-05-08T01:05:06Z","last_seen":"2026-10-06T21:49:56.609233Z","times_seen":30,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":263,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/css/customVodafone.css?v=18062024003","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.841Z","timestamp":1791323288841,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /css/customVodafone.css?v=18062024003 HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 20 May 2024 10:56:01 GMT\r\netag: W/\"2263-618e08c02d240\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":8803,"size_decoded":1888,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"96dd7d0f4b59d06f206f4242e8f25609","sha1":"8880d46b3979353015baad8c9c7708846eb7d925","sha256":"c9ef74352d02e850ce5cb5e4578ae8420bf518102cac51e862d57ff209be4db5","sha512":"b26f9828acb23c80ab37197cdacbb6c7b68c6225c32519af7553146a71441eb324c4b6dfba5146ccecf891eb624dfbd0f791df588d4fac7d5f04f388e61306e3","ssdeep":"96:3Fc43JjcaT4cQqNwG3yoMiHlFzDIVeWvuigqL5/K1tgqLlq5JCw2U00/K1oTgjKJ:KXwQJK15lID0MK12V","tlshash":"5502649c948228c2f1368a6cb7d55bd0fb3910134a060569f7ef2ba4aff59704267f8c","first_seen":"2026-06-30T01:47:30.044489Z","last_seen":"2026-10-06T21:49:56.609906Z","times_seen":3,"resource_available":true,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":135,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/plugins/js/all.min.js","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.844Z","timestamp":1791323288844,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /plugins/js/all.min.js HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Feb 2023 14:55:18 GMT\r\netag: W/\"32458f-5f57351532180\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3294607,"size_decoded":763296,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (47454), with NEL line terminators","md5":"bf60c5289c091181a8fee5c4ff453c37","sha1":"d5bd34862dd54dcd3b7bc485df1cede4ce5c7b72","sha256":"f7807b5e99761f0e40fb9f32f0c1c963975f03850fc1d51f2941c83f82ba634b","sha512":"80ade29b564db10decec1ceb01b49faf6474012ba4fa38e24ee973651bf2cd87298da8229d3db04a90eca81db0b88e048e160b9a7dca50ca910daadd2f78fd23","ssdeep":"6144:gyAUAPRpJb7cs50rOG2cvOe93ak6afZLHyWwNMKYXyDqfx6p54P0:gyAfpJb/0rtOOsaBLyWMH","tlshash":"3c25b58db691b0b246e761f4002f910bf17ba955b48a85c0f26ad9d4adbcc8e5077f3c","first_seen":"2025-11-07T03:59:52.580939Z","last_seen":"2026-10-06T21:49:56.613406Z","times_seen":13,"resource_available":true,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/fonts/vodafone-regular.woff2","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:09.964Z","timestamp":1791323289964,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /fonts/vodafone-regular.woff2 HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/css/customVodafone.css?v=18062024003\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:10 GMT\r\ncontent-length: 25572\r\nlast-modified: Mon, 13 May 2024 09:18:23 GMT\r\netag: \"63e4-618525df535c0\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25572,"size_decoded":25866,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 25572, version 1.0","md5":"c7f7eb052c9977c13405f81d5042b145","sha1":"177b310ceb754ef4e1a5ace9c2eb4cf5a7a5198c","sha256":"429009673f65119c167a97d5863e04f751b0dfea560a096769bb4a57359d8fc2","sha512":"b53cbf8f48af38d14ed09bd056cbb554fa8a0f198d0ff4a10a61f7654a0938093a01a0ba1ed75f72342e79261b0883a7495def848fe6e3ecea0e52ecaa17741d","ssdeep":"768:UMDVfjUqYfL352CSv0NLvHSbPU+F3DlbMmA:U8V8fQCSiLv6zFTJA","tlshash":"c3b2f12dfe466c76ef32e076352963b4a0542483a1df1a62e8f54d28d18c0becc5ccb9","first_seen":"2026-03-04T15:24:36.163912Z","last_seen":"2026-10-06T21:49:56.614287Z","times_seen":5,"resource_available":false,"data":null}},"time_used":621,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":567,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.834Z","timestamp":1791323288834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 07 Sep 2026 14:43:48 GMT","end":"Sun, 06 Dec 2026 15:43:45 GMT"},"fingerprint":{"sha1":"70:B5:44:5C:25:65:CF:4A:4B:DB:6F:16:E1:4E:D9:85:C7:F3:75:4E","sha256":"63:B5:DA:B8:4F:95:99:9A:4B:77:FF:DB:3F:8D:7E:3D:1A:62:AD:A9:D9:06:9E:C3:59:6F:4A:61:A2:D2:20:CB"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.0.0/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver-timing: cfExtPri\r\nserver: cloudflare\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: text/css; charset=utf-8\r\npriority: u=2,i=?0\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\nage: 1120940\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 07 Feb 2022 21:01:39 GMT\r\nvary: Accept-Encoding\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nx-cdnjs-cache: HIT\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EyygILNDUxlc2orVwPHzeWASGA4mo0OBwg%2FfXCb%2FzVGbu45l5FPbbRgdRvmHtYIq9j2BygAt8QXbrumKkMoqnfIHy%2FFbeVy5im1suXlsU%2Bzo1m0pvN3EuPy6fnJgGKK6%2Fc3XFHCe\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\ncf-ray: a467de5b4cad8be6-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-length: 15248\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":89220,"size_decoded":16257,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65317)","md5":"dfb8fc36e102730fddf78b5494eb0035","sha1":"b513d9a39af2ee145f12c1ba03f9982960c47029","sha256":"8d321d88cb97fdedc3189506c25de9292c6e73a60ebaab496243346c6404480e","sha512":"f6eb006b5d0844ed078689e9c80215a63af294fbe80f088f52229d5a4e6ddcfca8958d5c39de03484d066beae2e00b93ae83d1e5a42f5d4f710baa8e3e7cc57a","ssdeep":"1536:iUMVM6MVMkMVM9MVMNMVMispxd1zJJ29Nll3IV7UHsR+z:Dd1NY95IV7UMR+z","tlshash":"8a93a9e9e04c05d56732c44baf99b37ca5b6f73cd5810da9f02f580c19d26a822c6f7a","first_seen":"2023-04-06T16:57:15Z","last_seen":"2026-10-13T02:28:37.478966Z","times_seen":15607,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":2,"connect":12,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/css/mdb.min.css?v=100","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.838Z","timestamp":1791323288838,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /css/mdb.min.css?v=100 HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:08 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Feb 2023 14:55:18 GMT\r\netag: W/\"68bb2-5f57351532180\"\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":428978,"size_decoded":55169,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (59110)","md5":"b14085ffdf16f7c3476d741543b58d44","sha1":"2c2a325962ab6bb61d5418e27ab3bc6cc731df36","sha256":"d5b40bba7c107a1082475be54bfc9011dbd951dd1af37ad9a760e79674ae4a91","sha512":"468c11bcec5e76be7f8278207206eddec5e4282cda05bc189656858915b2adc109c9ecde2cfea46c7384b57a6b1e4219b3ef3b28afe07df8ac0dd349e2cd9ecd","ssdeep":"6144:Gtm9UfIE/NFrGSZuq4iaEpz600IZPwy/4eJBJFZE:XkxVFZE","tlshash":"5c949495f151346de8ab8119a5d0bbfe0e2f6d82f7015ebaf213239843ca6d71573e08","first_seen":"2025-11-24T01:32:18.131853Z","last_seen":"2026-10-06T21:49:56.615794Z","times_seen":6,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":137,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"vodafone-form.mhmr.ro/img/Zoom%20Beach_premiu.png","fqdn":"vodafone-form.mhmr.ro","domain":"mhmr.ro","tld":"ro"},"ip":{"addr":"193.189.99.18","port":443,"asn":33925,"as":"Global Internet Solutions SRL","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vodafone-form.mhmr.ro/","date":"2026-10-06T21:48:08.855Z","timestamp":1791323288855,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vodafone-form.mhmr.ro","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 15:20:17 GMT","end":"Mon, 16 Nov 2026 15:20:16 GMT"},"fingerprint":{"sha1":"98:E8:9A:1B:3A:6E:32:60:4B:3F:CC:51:AC:FC:AC:28:C6:30:41:0C","sha256":"13:08:64:56:72:B7:69:B2:4C:44:0C:E1:DA:BE:1C:C1:B5:5D:8C:26:40:4B:94:F6:49:4B:9F:1B:AB:B4:B1:38"}}},"request":{"raw":"GET /img/Zoom%20Beach_premiu.png HTTP/1.1\r\nHost: vodafone-form.mhmr.ro\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vodafone-form.mhmr.ro/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 06 Oct 2026 21:48:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 958582\r\nlast-modified: Wed, 17 Jun 2026 08:19:33 GMT\r\netag: \"ea076-6546eb8278f40\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15768000; includeSubDomains\r\nx-powered-by: PleskLin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Plesk","description":"Plesk is a web hosting and server data centre automation software with a control panel developed for Linux and Windows-based retail hosting service providers.","website":"https://www.plesk.com","common_platform_enumeration":"cpe:2.3:a:parallels:parallels_plesk_panel:*:*:*:*:*:*:*:*","icon":"Plesk.svg","categories":["Hosting panels"]}],"data":{"size":958582,"size_decoded":958903,"mime_type":"image/png","magic":"PNG image data, 2734 x 1906, 8-bit colormap, non-interlaced","md5":"b25d9858a6bae843de9f879dfc8cec0b","sha1":"70180cb8d809aa08a6a8295584a06109f838af75","sha256":"a59ca99904d4d54588dc5033f74b323cefa34a24d2d4164e5465ab61e32d9287","sha512":"3f609ed39a675b146bd31b9450ba8f3e0d5e435a0d8087a09c26f050c33032ab1cb639d07f9f7aea08e2d7c57af1aaac72a6638876c512401d2ab8f1e473db77","ssdeep":"24576:ut98rv7hlOsyaHSS2Q73pRbpB3lrmMtJPPXZVFTan0CzTXVy:vTh1yQZRlB3lrZJPfYn0CXY","tlshash":"fd1533293ed06893d4d4f874fe4277ca35d3c9eecd12085ca9954fa666309e774ea0e0","first_seen":"2026-10-06T21:20:10.70622Z","last_seen":"2026-10-06T21:49:56.616567Z","times_seen":2,"resource_available":false,"data":null}},"time_used":4360,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":718,"receive":3642,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-10-06","alert":"Sinkholed","trigger":"vodafone-form.mhmr.ro","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-10-06","alert":"Phishing Block","trigger":"vodafone-form.mhmr.ro","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}