{"report_id":"86a7b2ae-e206-4356-b7eb-0c6c2f90d681","version":0,"status":"done","tags":[],"date":"2026-09-05T15:33:25Z","url":{"schema":"http","addr":"gudwa.com/DocuSign/e-sign.php","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":0,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign.php","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"title":"e-sign","dom":{"size":6627,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3308)","md5":"97006b23041bf58e5237c4428dd5aa40","sha1":"f9ed66109b701ce28866138e85db929a236761ff","sha256":"1e3f91f2bfbf055e3a6f006a9dbba6e2a8612f8f8a6e92d5c3c35fd94999eba4","sha512":"943ea1983c9180daada0993f2e302fb07efdb7b183baf2002f293522358c3247dc3469bc18db83577649b1b683773be2b753ba4cef56193a2d0a0787537a914e","ssdeep":"192:N9S2fsVcOgyExA9vzp9wRp6kU+RvVa2HMp7:N5U4vVa2M","tlshash":"9dd1844387a343796c0a816c5bf1250430aac817e078e9f47fdf1495ef4e9e068aa7de","dom_hash":"domhashbba58f53c4ffeeee7e4911a079f7bda1","first_seen":"2026-04-20T13:36:06.163656Z","last_seen":"2026-09-06T01:12:52.278638Z","times_seen":26,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gudwa.com/DocuSign/e-sign.php","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":0,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T15:33:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"gudwa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"gudwa.com","ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"domain_registered":"2026-07-06","domain_rank":0,"first_seen":"2026-08-14T11:45:16.898314Z","last_seen":"2026-09-04T23:13:00.961941Z","alert_count":12,"request_count":4,"received_data":138940,"sent_data":2055,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-30T22:22:21.72184Z","alert_count":0,"request_count":2,"received_data":98138,"sent_data":1068,"comment":"","tags":null,"fingerprints":null},{"fqdn":"i.ibb.co","ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"domain_registered":"2010-07-20","domain_rank":21643,"first_seen":"2018-11-25T10:13:48Z","last_seen":"2026-09-04T07:15:02.597085Z","alert_count":0,"request_count":1,"received_data":1169,"sent_data":534,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign.php","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2da15941723e8ee3e6213a4398bc670e","sha1":"0b9c9273517b001b7a7233276dca23d8feb78061","sha256":"3b4641e1a9f9e74b01ab595df48a7cc96989246afcfe239ba25164fa958ac7c5","sha512":"f10cf947c04c6df4bd7b6fdd4adc946c0e446243e7dce2d08b9987656fd5f4d590e600331ca020f5e9f0451226c9393c3fe5f27bd03ede436e8d7b6e15c7d7ab","ssdeep":"","tlshash":"43a0029f58a396481a9a3432895f220e316f00f7140d9500aa22e6b5ba7473f8237acb","size":71,"data":"","first_seen":"2026-07-23T05:08:53.831077Z","last_seen":"2026-09-06T01:12:52.289237Z","times_seen":16,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign_files/css2","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.532Z","timestamp":1788622368532,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.gudwa.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 15:00:42 GMT","end":"Sun, 04 Oct 2026 15:00:41 GMT"},"fingerprint":{"sha1":"BC:5D:8E:11:74:C6:35:94:72:BE:EE:0A:04:A5:C2:D1:49:1F:30:B9","sha256":"C4:45:1C:04:BB:44:D0:39:9F:BF:A1:CD:D6:3D:26:8A:84:6B:DC:64:BD:28:D3:A3:7D:05:8E:E4:98:26:1E:12"}}},"request":{"raw":"GET /DocuSign/e-sign_files/css2 HTTP/1.1\r\nHost: gudwa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/DocuSign/e-sign.php\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Tue, 03 Feb 2026 08:30:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 7413\r\ndate: Sat, 05 Sep 2026 15:32:48 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":7413,"size_decoded":7770,"mime_type":"text/css","magic":"ASCII text","md5":"23e2689ce1752d7841b676cf5f7b23f5","sha1":"68e168e64900e0ea22b66ae6013d48eba488e474","sha256":"ef808d096b5eef8f120add8e5005cb83f59eaf1cb1260c3ea0472b7994345986","sha512":"04fea0978eb6b46bb06645df1af17dbd8946c11ca8c88c641d0391d9c98167400baebec7186b439e07b20927e0c9a8a50a1d9eca67fac489c83b475550ceb0ec","ssdeep":"192:9NNsR234qhDYNr2/23ighlfNEV423RHhGu:rLWFdyT","tlshash":"f6e19a92006b9500ab471dc223cf7f366ece10996086d1bd6ffd1cca9cead66436875e","first_seen":"2025-09-21T11:49:19.344616Z","last_seen":"2026-09-06T01:12:52.281242Z","times_seen":104,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":146,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"gudwa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign_files/laptop_docusign.png","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.539Z","timestamp":1788622368539,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.gudwa.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 15:00:42 GMT","end":"Sun, 04 Oct 2026 15:00:41 GMT"},"fingerprint":{"sha1":"BC:5D:8E:11:74:C6:35:94:72:BE:EE:0A:04:A5:C2:D1:49:1F:30:B9","sha256":"C4:45:1C:04:BB:44:D0:39:9F:BF:A1:CD:D6:3D:26:8A:84:6B:DC:64:BD:28:D3:A3:7D:05:8E:E4:98:26:1E:12"}}},"request":{"raw":"GET /DocuSign/e-sign_files/laptop_docusign.png HTTP/1.1\r\nHost: gudwa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/DocuSign/e-sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sat, 12 Sep 2026 15:32:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 03 Feb 2026 08:30:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 78911\r\ndate: Sat, 05 Sep 2026 15:32:48 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":78911,"size_decoded":79195,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1024x1024, components 3","md5":"586177a06c624bc140c86e6ffbd61025","sha1":"9408a180650e80a1b78ce7d88e022b16602979fd","sha256":"c303b98ce42b600960a2b9e25b45d7106248d74eb16db1a182c3e51c61c49d74","sha512":"69ff17621af65c392dbb7fd84fd1792baf914a5835109a6836f3e50011efe530eb3c48c42053470ab393311cfa10bde96aaf3dd65cab1d9da92a67b7d93b7174","ssdeep":"1536:/0XV0/kX7p+hjB3w+vUX8sEHqycsmHjFwRKUizs8aop5cMjImlKG:iV0MX7pO1UUKyIxwY30op5cMB","tlshash":"4d73021fcb1c09fef1db2bfabce3672a2f19194438b945527f8a1a3606590153c2e745","first_seen":"2025-12-12T18:04:16.711899Z","last_seen":"2026-09-06T01:12:52.282979Z","times_seen":148,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":189,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"gudwa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign_files/time.png","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.541Z","timestamp":1788622368541,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.gudwa.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 15:00:42 GMT","end":"Sun, 04 Oct 2026 15:00:41 GMT"},"fingerprint":{"sha1":"BC:5D:8E:11:74:C6:35:94:72:BE:EE:0A:04:A5:C2:D1:49:1F:30:B9","sha256":"C4:45:1C:04:BB:44:D0:39:9F:BF:A1:CD:D6:3D:26:8A:84:6B:DC:64:BD:28:D3:A3:7D:05:8E:E4:98:26:1E:12"}}},"request":{"raw":"GET /DocuSign/e-sign_files/time.png HTTP/1.1\r\nHost: gudwa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/DocuSign/e-sign.php\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Sat, 12 Sep 2026 15:32:48 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 03 Feb 2026 08:30:46 GMT\r\naccept-ranges: bytes\r\ncontent-length: 44677\r\ndate: Sat, 05 Sep 2026 15:32:48 GMT\r\nserver: LiteSpeed\r\nvary: User-Agent\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":44677,"size_decoded":44961,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1280x469, components 3","md5":"abcfaecf71835abf18161c03d54d6018","sha1":"83add751a12a1fa5cebc7d0835a595712eab94f3","sha256":"dd36a6e9d1367feaf373528baa1d210d445d9b1355a4833ceed34b265aadaaad","sha512":"7d6f34d62eff46112e8df3807d9d729de2a81f1113bdb10f130bbebb77cc8a3c54d7d00afde5fc254307742b396da3d9526f8430a447e9c68a9cffbf3e09a704","ssdeep":"768:5PsR6c+5TPH8ajYTvxynuOr5dfVHNNbyoonR70/KC274xbkztQ/iPrrr82+aY:52z+5bHPYIndfVtNbA70/KdbjTrr81","tlshash":"b813d043ef4a94c5cf26cb706d29e96b9b46cf02b650db07c55fa015e18e8f2ae490d4","first_seen":"2025-12-12T18:04:16.710199Z","last_seen":"2026-09-06T01:12:52.284425Z","times_seen":149,"resource_available":false,"data":null}},"time_used":374,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":332,"receive":42,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"gudwa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.687Z","timestamp":1788622368687,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://gudwa.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48256\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 03 Sep 2026 07:36:57 GMT\r\nexpires: Fri, 03 Sep 2027 07:36:57 GMT\r\ncache-control: public, max-age=31536000\r\nage: 201351\r\nlast-modified: Tue, 09 Sep 2025 18:33:53 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48256,"size_decoded":49069,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-09-07T00:49:50.466946Z","times_seen":29295,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":0,"dns":3,"connect":34,"send":0,"wait":16,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.692Z","timestamp":1788622368692,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://gudwa.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48256\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 03 Sep 2026 07:36:57 GMT\r\nexpires: Fri, 03 Sep 2027 07:36:57 GMT\r\ncache-control: public, max-age=31536000\r\nage: 201351\r\nlast-modified: Tue, 09 Sep 2025 18:33:53 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48256,"size_decoded":49069,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48256, version 1.0","md5":"260c81a4759baf163c025001c4f27872","sha1":"f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298","sha256":"3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62","sha512":"9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9","ssdeep":"768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw","tlshash":"be2302df9e4d72d29271267045338383798e2d8a50aae7a1061c0fe6de05b69d31fb9c","first_seen":"2025-05-30T10:47:22.433446Z","last_seen":"2026-09-07T00:49:50.466946Z","times_seen":29295,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":18,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.ibb.co/yF35Jv2Q/docu-ico.png","fqdn":"i.ibb.co","domain":"ibb.co","tld":"co"},"ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gudwa.com/DocuSign/e-sign.php","date":"2026-09-05T15:32:48.926Z","timestamp":1788622368926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ibb.co","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 21:52:48 GMT","end":"Tue, 10 Nov 2026 21:52:47 GMT"},"fingerprint":{"sha1":"2F:89:8C:0E:0D:5A:32:08:66:DB:ED:13:DC:0A:60:1E:F1:27:D6:7C","sha256":"69:B6:46:09:83:BD:EC:DC:D7:58:12:75:FA:A5:C2:22:BA:67:5E:C8:27:39:AC:F1:20:06:D1:14:1B:20:E7:D5"}}},"request":{"raw":"GET /yF35Jv2Q/docu-ico.png HTTP/1.1\r\nHost: i.ibb.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://gudwa.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: openresty\r\ndate: Sat, 05 Sep 2026 15:32:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 1031\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1031,"size_decoded":1169,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 4-bit colormap, non-interlaced","md5":"7325e2012a6cf941a6ea14f0061ff764","sha1":"0d2ba63e280b979a98bc431bec8a7af985578769","sha256":"63e3696c5e5e8b037e28e8fbef871184b0d1d60a7314c965b1426d9cce84dd69","sha512":"602ab2e43f39d22edc6368f8c82cac6f7ffd2120f5eecaf7b129381044452c3c29ab88befada1ca789604ffaa180ac5f6776f4132b4aa648baf962add500d7b6","ssdeep":"","tlshash":"bb11d812ade29148cbdba42513e363a00e4419be1411a221e614a72e5bd8284764f319","first_seen":"2023-05-01T10:28:56Z","last_seen":"2026-09-06T01:12:52.287654Z","times_seen":3178,"resource_available":false,"data":null}},"time_used":2068,"timings":{"blocked":-1,"dns":2,"connect":27,"send":0,"wait":293,"receive":0,"ssl":1745},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gudwa.com/DocuSign/e-sign.php","fqdn":"gudwa.com","domain":"gudwa.com","tld":"com"},"ip":{"addr":"65.181.116.251","port":443,"asn":36454,"as":"WHG Hosting Services Ltd","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T15:32:47.701Z","timestamp":1788622367701,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.gudwa.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 15:00:42 GMT","end":"Sun, 04 Oct 2026 15:00:41 GMT"},"fingerprint":{"sha1":"BC:5D:8E:11:74:C6:35:94:72:BE:EE:0A:04:A5:C2:D1:49:1F:30:B9","sha256":"C4:45:1C:04:BB:44:D0:39:9F:BF:A1:CD:D6:3D:26:8A:84:6B:DC:64:BD:28:D3:A3:7D:05:8E:E4:98:26:1E:12"}}},"request":{"raw":"GET /DocuSign/e-sign.php HTTP/1.1\r\nHost: gudwa.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 2579\r\ncontent-encoding: br\r\nvary: Accept-Encoding,User-Agent\r\ndate: Sat, 05 Sep 2026 15:32:48 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":6627,"size_decoded":2966,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3308)","md5":"8ef6bb17e5fe9f4b2fbf6ae2e69d9cd1","sha1":"fdb1943270742dff72763833e120ba02d8d04bf2","sha256":"2b89225801591cd223e0cf0b1faa8e7b12e88d6b6bc6ec9f5e715171137553ac","sha512":"ec9ce30b2642f686c6d711689dfe84138f767a3bbf3a7822fd28f688f9cb5796e55cd52a92310a466734013c603e81c15b12a5028fc51b68120e5f4e7c2a7003","ssdeep":"192:N9S2fsVcOgyExA9vzp9wRp6kU+RvVa2HMpJ:N5U4vVa26","tlshash":"4ad1944387a343795c0a816c5bf1250430aac817e078e9f43fdf1495ef4e9e068aa7de","first_seen":"2026-04-20T13:36:06.167893Z","last_seen":"2026-09-06T01:12:52.280014Z","times_seen":26,"resource_available":true,"data":null}},"time_used":620,"timings":{"blocked":-1,"dns":25,"connect":144,"send":0,"wait":156,"receive":0,"ssl":295},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"gudwa.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"gudwa.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}