{"report_id":"89b60c68-6866-4df7-b555-d256e8e767cb","version":6,"status":"done","tags":[],"date":"2026-03-20T18:38:18Z","url":{"schema":"http","addr":"echo-ai.factory06.bluelines.se","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":0,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"final":{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"title":"Echo AI","dom":{"size":39308,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"cef0b9120570a3ea2debc8d618b73013","sha1":"8e96e2375f27f82a3bd39f7a7064ad54b02c0e67","sha256":"d4aadad1a0ff6375719bd74721cfba51effa47dbfdceccab377113697583a638","sha512":"598b3062739bbcf32929f7e53a90af6a1e1e43a292a15458beca9af57690d8cf5de22dcc287f6235e364da09dfb71aec5b175ab56647234fc7ae159a959caf8b","ssdeep":"384:8rxkHIbx981gci1kZSLH4bbrq0E/HC4h56S9HclwPcLzn9k4RyHUTfzHK1:Akobx981gci1kZSLH4fOHC4h56sHcpk","tlshash":"ed03d66775f7007569a7a1aa37eb57463224e103e90ac9183edc93988f82fd885737cc","dom_hash":"domhashb77111d5522741998669d80b221ad471","first_seen":"2026-03-20T14:27:55.384403Z","last_seen":"2026-03-20T19:17:34.462744Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"echo-ai.factory06.bluelines.se","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":0,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-24T18:38:18Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"echo-ai.factory06.bluelines.se","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-03-15T22:19:58.945817Z","alert_count":0,"request_count":1,"received_data":12474,"sent_data":536,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-03-15T22:16:12.279722Z","alert_count":0,"request_count":3,"received_data":84213,"sent_data":1737,"comment":"","tags":null,"fingerprints":null},{"fqdn":"echo-ai.factory06.bluelines.se","ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"domain_registered":"2026-02-10","domain_rank":0,"first_seen":"2026-03-20T14:27:51.686851Z","last_seen":"2026-03-20T14:27:51.686851Z","alert_count":3,"request_count":3,"received_data":40320,"sent_data":1415,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":true,"md5":"4f300e85e7c93eda68df702c28d23ff6","sha1":"19e6a92fecc15cbb32525624db40345f6f02db10","sha256":"0c83ed4fdeda0bc1a1ad5418a2c804b6d3573e8a651bfc959ff17a2b234404f3","sha512":"3ebabca2b4a131d201d8272019b7e1f190617b6ea3976ab822e66b7dc1580915e4fa7a3eda44bb402d972402e244da5c54762f239449d05246bf5c8a8c3f247a","ssdeep":"384:7LH4bbrq0E/HC4h56S9HclwPcLzn9k4RyHUTfzHKI:7LH4fOHC4h56sHcp1","tlshash":"8082726b39fb10304beba4eb63c75794392881473905d5047eacc7984f95f4192babce","size":17830,"data":"","first_seen":"2026-03-20T14:27:55.389302Z","last_seen":"2026-03-20T19:17:34.470399Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/auth-config.js","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"introduction_type":"scriptElement","is_inline":false,"md5":"5c0c8835618daec24aa65042352c2ffe","sha1":"5c3f5ebf4d379ade9f135530b345fa1d4bcfbbd2","sha256":"c846761c484808a539ed05347772ad4306cbbf716074ac1e994dcfb2144bde92","sha512":"bc8b490937119d94c78eafb0338e1267f260bc5fe2b75c8ce9c8f0e2324793fbc9a878559ccfdc3e10d0390074ba675d20a794c61c1ca2fc5f1e6c7af19ee652","ssdeep":"","tlshash":"42b01248480148d82ab8041013317a51a546005d43321038b0e0836eac01f4f0802147","size":89,"data":"","first_seen":"2026-03-20T14:27:55.388326Z","last_seen":"2026-03-20T19:17:34.469325Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700\u0026family=JetBrains+Mono:wght@400;500\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.239Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"63:D1:AE:99:1E:49:D7:6C:71:F3:BA:F5:BA:47:74:1E:EB:90:E7:D6","sha256":"69:90:BB:9D:82:60:82:88:FF:CE:F6:B3:3D:DD:B5:B5:FB:F0:56:17:FD:FA:0D:BC:9C:5B:83:51:98:0D:2F:CF"}}},"request":{"raw":"GET /css2?family=Plus+Jakarta+Sans:wght@400;500;600;700\u0026family=JetBrains+Mono:wght@400;500\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://echo-ai.factory06.bluelines.se/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Fri, 20 Mar 2026 18:37:57 GMT\r\ndate: Fri, 20 Mar 2026 18:37:57 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11788,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1eb7067a8c4607ed1dee52a71add21ba","sha1":"72fb6c1c9fcf0d19e8c2d544e4eb6014099a2aa9","sha256":"c7181a1e87c29458decfd07369c09170745d4439b9c431d18527dc4556d221e2","sha512":"a5a2d84cb38945250696739a089de86f8242b45df5deae85bcd57bf3b69227ec8bcd10377c01c10b13da6c37efd5e4b282ff91cbebc1258851c4977040f55a71","ssdeep":"192:uG+7p3ZAXYjG9Up3qnXfGCFJRSdCmaRBUCj3Ro7CcQRvd:fOGCYdrFn","tlshash":"5732eda0041f9500ea431cc663cf7e3aad9e61562045d4f99bfe1858ecaec3a2374b5d","first_seen":"2026-01-10T16:53:10.774539Z","last_seen":"2026-08-04T08:47:37.394411Z","times_seen":42,"resource_available":false,"data":null}},"time_used":147,"timings":{"blocked":61,"dns":0,"connect":8,"send":0,"wait":20,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://echo-ai.factory06.bluelines.se\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 27236\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 14 Mar 2026 23:55:27 GMT\r\nexpires: Sun, 14 Mar 2027 23:55:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 499350\r\nlast-modified: Tue, 09 Sep 2025 18:38:58 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27236,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27236, version 1.0","md5":"a8c28b27501f763423d96717c43243df","sha1":"e845ac57b3fee2c68ec6cdb95114ef3541fa3d11","sha256":"b6698c39332c51112c720e8a92608b4eeed502f654b63fc1693b8cccfc856d4d","sha512":"3e3af79fd415b3e4d3cbcd7f9bce2a7fa5c09b1ad5a38c6f2e971852c7973eae1b8ac85a4664f8c7af34f6c489f563cc35f82aecd32b1be8af70ce2612b0e3d3","ssdeep":"384:TOfiFJZpa1LuoEeC5s2xCWnEgdMqCF+FSe5LuxyrPyP2hbgBizhxCvw9k3kwA0y2:XW1l+s2xC8LSs2P2yitawWU50Z","tlshash":"f5c2e0676b05362dbcc47380135b8f262a5071b5566cca61787bef4e3a9b03a903cba5","first_seen":"2025-06-03T19:01:05.870661Z","last_seen":"2026-08-11T07:55:05.525677Z","times_seen":20060,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":51,"dns":1,"connect":8,"send":0,"wait":9,"receive":7,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://echo-ai.factory06.bluelines.se\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 27236\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 14 Mar 2026 23:55:27 GMT\r\nexpires: Sun, 14 Mar 2027 23:55:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 499350\r\nlast-modified: Tue, 09 Sep 2025 18:38:58 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27236,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27236, version 1.0","md5":"a8c28b27501f763423d96717c43243df","sha1":"e845ac57b3fee2c68ec6cdb95114ef3541fa3d11","sha256":"b6698c39332c51112c720e8a92608b4eeed502f654b63fc1693b8cccfc856d4d","sha512":"3e3af79fd415b3e4d3cbcd7f9bce2a7fa5c09b1ad5a38c6f2e971852c7973eae1b8ac85a4664f8c7af34f6c489f563cc35f82aecd32b1be8af70ce2612b0e3d3","ssdeep":"384:TOfiFJZpa1LuoEeC5s2xCWnEgdMqCF+FSe5LuxyrPyP2hbgBizhxCvw9k3kwA0y2:XW1l+s2xC8LSs2P2yitawWU50Z","tlshash":"f5c2e0676b05362dbcc47380135b8f262a5071b5566cca61787bef4e3a9b03a903cba5","first_seen":"2025-06-03T19:01:05.870661Z","last_seen":"2026-08-11T07:55:05.525677Z","times_seen":20060,"resource_available":false,"data":null}},"time_used":125,"timings":{"blocked":52,"dns":0,"connect":21,"send":0,"wait":11,"receive":4,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.447Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 23 Feb 2026 18:21:09 GMT","end":"Mon, 18 May 2026 18:21:08 GMT"},"fingerprint":{"sha1":"D5:23:F9:83:DE:D4:E8:AB:85:EF:63:D4:2C:6E:62:44:96:04:04:8E","sha256":"D3:04:E0:CB:3E:1B:51:D2:DD:21:AB:B5:3E:6D:E3:40:D7:D5:1E:07:D1:8A:BF:8C:CC:01:FC:AE:92:1F:69:2D"}}},"request":{"raw":"GET /s/plusjakartasans/v12/LDIoaomQNQcsA88c7O9yZ4KMCoOg4Ko20yyghfvaZ-E.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://echo-ai.factory06.bluelines.se\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 27236\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 14 Mar 2026 23:55:27 GMT\r\nexpires: Sun, 14 Mar 2027 23:55:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 499350\r\nlast-modified: Tue, 09 Sep 2025 18:38:58 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":27236,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27236, version 1.0","md5":"a8c28b27501f763423d96717c43243df","sha1":"e845ac57b3fee2c68ec6cdb95114ef3541fa3d11","sha256":"b6698c39332c51112c720e8a92608b4eeed502f654b63fc1693b8cccfc856d4d","sha512":"3e3af79fd415b3e4d3cbcd7f9bce2a7fa5c09b1ad5a38c6f2e971852c7973eae1b8ac85a4664f8c7af34f6c489f563cc35f82aecd32b1be8af70ce2612b0e3d3","ssdeep":"384:TOfiFJZpa1LuoEeC5s2xCWnEgdMqCF+FSe5LuxyrPyP2hbgBizhxCvw9k3kwA0y2:XW1l+s2xC8LSs2P2yitawWU50Z","tlshash":"f5c2e0676b05362dbcc47380135b8f262a5071b5566cca61787bef4e3a9b03a903cba5","first_seen":"2025-06-03T19:01:05.870661Z","last_seen":"2026-08-11T07:55:05.525677Z","times_seen":20060,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":60,"dns":0,"connect":23,"send":0,"wait":9,"receive":4,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/favicon.ico","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"echo-ai.factory06.bluelines.se","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 18:35:52 GMT","end":"Wed, 17 Jun 2026 18:35:51 GMT"},"fingerprint":{"sha1":"B7:3D:A3:A8:54:D4:80:AB:C8:A0:B9:50:28:51:13:BF:76:7E:CF:1D","sha256":"27:FE:F1:6B:E8:38:FB:5A:F5:E1:6F:5F:69:C2:BC:63:1D:13:CC:47:C1:7D:E1:0D:57:38:BF:EB:50:77:49:CA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: echo-ai.factory06.bluelines.se\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://echo-ai.factory06.bluelines.se/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Fri, 20 Mar 2026 18:37:57 GMT\r\ncontent-type: text/html\r\ncontent-length: 153\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":153,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"fbfaa4844d199fdb4d1b168b43970580","sha1":"1d2b51049015bdae90fd3cd72260a92be0253233","sha256":"eda336b0ba6d1927d4b2b52ffb153e8f0b5732d89c3b627cf6adda1c861cffaf","sha512":"e982895d6b6447786ac020277b65f8ccef0ffe48f0636598fcc78a6d3762440190dbc45f8d7d094f24ee42861140ada9de6bb2da4b7d0e9cb48f21e4db9bc492","ssdeep":"","tlshash":"4cc02b2d35137c4cc663317422c37090e0c6833764ba41228400814731cf2998ac339b","first_seen":"2026-03-18T05:41:21.811064Z","last_seen":"2026-07-11T15:56:08.066558Z","times_seen":62,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"echo-ai.factory06.bluelines.se","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-20T18:37:56.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"echo-ai.factory06.bluelines.se","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 18:35:52 GMT","end":"Wed, 17 Jun 2026 18:35:51 GMT"},"fingerprint":{"sha1":"B7:3D:A3:A8:54:D4:80:AB:C8:A0:B9:50:28:51:13:BF:76:7E:CF:1D","sha256":"27:FE:F1:6B:E8:38:FB:5A:F5:E1:6F:5F:69:C2:BC:63:1D:13:CC:47:C1:7D:E1:0D:57:38:BF:EB:50:77:49:CA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: echo-ai.factory06.bluelines.se\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 20 Mar 2026 18:37:57 GMT\r\ncontent-type: text/html\r\ncontent-length: 39213\r\nlast-modified: Fri, 20 Mar 2026 12:15:04 GMT\r\netag: \"69bd3a48-992d\"\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nreferrer-policy: strict-origin-when-cross-origin\r\npermissions-policy: microphone=(self), camera=()\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39213,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"bd8664df673ecc37e138fc046ff38960","sha1":"e7901c32c1f74b6c26ab84801d47be0ae5c244f8","sha256":"b5827967631f3514d0fbbc8de6b4497bbf83527387b247be1cc6ca8898118afc","sha512":"16bf3ef46410e9cb02fd0c8a47ca63d38233cd98f4cc9dc04a1cee600ad1208a4b5a9753469b8b3143c0fbd195254b14750e20561bdd9df8deb399db67727e8b","ssdeep":"384:grLkHIbx981g4i1kUdLH4bbrq0E/HC4h56S9HclwPcLzn9k4RyHUTfzHKZ:Wkobx981g4i1kUdLH4fOHC4h56sHcpk","tlshash":"5903d66775f700756963a1aa37eb57463224e103a90ac9183edc93d88f82fd895737cc","first_seen":"2026-03-20T14:27:55.386789Z","last_seen":"2026-03-20T19:17:34.467126Z","times_seen":3,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":75,"dns":3,"connect":29,"send":0,"wait":33,"receive":53,"ssl":39},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"echo-ai.factory06.bluelines.se","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-ai.factory06.bluelines.se/auth-config.js","fqdn":"echo-ai.factory06.bluelines.se","domain":"bluelines.se","tld":"se"},"ip":{"addr":"51.255.206.218","port":443,"asn":16276,"as":"OVH SAS","country":"France","country_code":"FR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://echo-ai.factory06.bluelines.se/","date":"2026-03-20T18:37:57.241Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"echo-ai.factory06.bluelines.se","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 19 Mar 2026 18:35:52 GMT","end":"Wed, 17 Jun 2026 18:35:51 GMT"},"fingerprint":{"sha1":"B7:3D:A3:A8:54:D4:80:AB:C8:A0:B9:50:28:51:13:BF:76:7E:CF:1D","sha256":"27:FE:F1:6B:E8:38:FB:5A:F5:E1:6F:5F:69:C2:BC:63:1D:13:CC:47:C1:7D:E1:0D:57:38:BF:EB:50:77:49:CA"}}},"request":{"raw":"GET /auth-config.js HTTP/1.1\r\nHost: echo-ai.factory06.bluelines.se\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://echo-ai.factory06.bluelines.se/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 20 Mar 2026 18:37:57 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 89\r\nlast-modified: Fri, 20 Mar 2026 12:16:53 GMT\r\netag: \"69bd3ab5-59\"\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"5c0c8835618daec24aa65042352c2ffe","sha1":"5c3f5ebf4d379ade9f135530b345fa1d4bcfbbd2","sha256":"c846761c484808a539ed05347772ad4306cbbf716074ac1e994dcfb2144bde92","sha512":"bc8b490937119d94c78eafb0338e1267f260bc5fe2b75c8ce9c8f0e2324793fbc9a878559ccfdc3e10d0390074ba675d20a794c61c1ca2fc5f1e6c7af19ee652","ssdeep":"","tlshash":"42b01248480148d82ab8041013317a51a546005d43321038b0e0836eac01f4f0802147","first_seen":"2026-03-20T14:27:55.388326Z","last_seen":"2026-03-20T19:17:34.469325Z","times_seen":3,"resource_available":true,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-20","alert":"Sinkholed","trigger":"echo-ai.factory06.bluelines.se","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}