{"report_id":"975d2f95-a729-4405-9294-155f3b8b1ea0","version":6,"status":"done","tags":[],"date":"2026-04-28T19:40:00Z","url":{"schema":"https","addr":"phantom-6uw.pages.dev","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"phantom-6uw.pages.dev/","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"title":"ARISTA Config Generator","dom":{"size":30630,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1262)","md5":"d4f259cbc086348820e37f89353e4fe6","sha1":"5196e8f70cde44bd4cfbab7cfebe7a132acc3d38","sha256":"de5b8875bbb6c703963801887c7a61ac5ac170142efab5ffa2f3617c46168656","sha512":"12dcfb31723d424250e803719ff36105e18692afcb7a0bf228d310896e6e4905fd172c8f14dfa986728c4ff3eb4cfb1e5515ca18ea1adfce946ece7efb245759","ssdeep":"192:R/ivKFMSX4Bb+huyPfCAS0oMF6wIM2OwclvlR68ogffjPh+++aCPIaCcjiXAzXAk:RKvE4EE7W7vnAzARy5OSsexwPBzf3c9","tlshash":"99d2097739634815858be4ea637b870632748213d902d89dfadc47e4cfc4e9cd537aa8","dom_hash":"domhash2602ffc657eb73cc000ecef7a8f1c5e4","first_seen":"2026-04-28T19:40:01.900329Z","last_seen":"2026-04-28T19:40:01.900329Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"phantom-6uw.pages.dev","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-02T19:40:00Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":0}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-04-28T19:39:38Z","timestamp":1777405178,"ip_dst":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":49380,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)","source":"{\"timestamp\":\"2026-04-28T19:39:38.461370+0000\",\"flow_id\":825063435328495,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.6\",\"src_port\":49380,\"dest_ip\":\"172.66.47.197\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2057746,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_11_20\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Description_Generated_By_Proofpoint_Nexus\"],\"updated_at\":[\"2024_11_20\"]}},\"tls\":{\"sni\":\"phantom-6uw.pages.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":923,\"bytes_toclient\":3549,\"start\":\"2026-04-28T19:39:38.449519+0000\"}}"}],"analyzer":null,"urlquery":null},"summary":[{"fqdn":"phantom-6uw.pages.dev","ip":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-09-02","domain_rank":0,"first_seen":"2026-04-28T19:40:00.054343Z","last_seen":"2026-04-28T19:40:00.054343Z","alert_count":0,"request_count":3,"received_data":32397,"sent_data":1364,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"phantom-6uw.pages.dev/","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a5f67610a462260dd0489918d9adc097","sha1":"4286d12b8fda33614d410323c6e6a6e8011dd6b0","sha256":"f7ccc44dea8394a9979c6c0d14b874dcc977e6ea5ea68c12c483adfd30edc0b6","sha512":"c43f664b56a4f83d7fb293fc4f828d7c3772b1217d205928081deef0c11c15cc38947dc34117c5d5155ef93b673f615a40afc2b5a56ba66806f6ab7eee99eba1","ssdeep":"96:wPRiZthifBEd15q+ib8giqshn2yLqy0ttpA/oh2fEx+cMPPNrwyd:wwBif2dPd3nuG0vp8f3cMPPNrwyd","tlshash":"fd22ee7b3ab30c354bab796b127f8349393081171d02ec96f9ac4a684fc0f50a077ea5","size":10119,"data":"","first_seen":"2026-04-28T19:40:01.907706Z","last_seen":"2026-04-28T19:40:01.907706Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"phantom-6uw.pages.dev/favicon.ico","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://phantom-6uw.pages.dev/","date":"2026-04-28T19:39:39.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom-6uw.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 16 Apr 2026 06:03:26 GMT","end":"Wed, 15 Jul 2026 07:02:08 GMT"},"fingerprint":{"sha1":"0C:87:91:93:6C:A1:13:DE:2F:CC:48:2E:28:D3:6B:0E:C5:6A:2B:C7","sha256":"64:52:F9:88:ED:EE:61:05:6B:CE:CF:28:E8:B0:B3:C1:7E:6C:73:CE:AD:A9:11:20:D1:FE:11:81:0E:EC:1D:93"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: phantom-6uw.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://phantom-6uw.pages.dev/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 28 Apr 2026 19:39:39 GMT\r\ncontent-type: text/plain;charset=UTF-8\r\ncontent-length: 9\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Y7yeDhu9Zi3XZ38%2FNN6VFr0DxHbqBomXWoaZ%2FAiP7OVyomPenLOV1Xf9WDNbVZlWi2X7XEjXceYY5Bho7r9kIiX571%2F9GO5q9BmLF%2BE5RNCWZZkhNrIwZth5EmEei2TW%2FMgMKaZbsS4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f3888c10bc90731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"9d1ead73e678fa2f51a70a933b0bf017","sha1":"d205cbd6783332a212c5ae92d73c77178c2d2f28","sha256":"0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5","sha512":"935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34","ssdeep":"","tlshash":"a250000c0003c3cc0000003030c0000000000300300000300000c000000000000c000c","first_seen":"2023-03-08T03:03:03Z","last_seen":"2026-08-09T05:04:12.004175Z","times_seen":88755,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phantom-6uw.pages.dev/api/settings","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://phantom-6uw.pages.dev/","date":"2026-04-28T19:39:39.047Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom-6uw.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 16 Apr 2026 06:03:26 GMT","end":"Wed, 15 Jul 2026 07:02:08 GMT"},"fingerprint":{"sha1":"0C:87:91:93:6C:A1:13:DE:2F:CC:48:2E:28:D3:6B:0E:C5:6A:2B:C7","sha256":"64:52:F9:88:ED:EE:61:05:6B:CE:CF:28:E8:B0:B3:C1:7E:6C:73:CE:AD:A9:11:20:D1:FE:11:81:0E:EC:1D:93"}}},"request":{"raw":"GET /api/settings HTTP/1.1\r\nHost: phantom-6uw.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://phantom-6uw.pages.dev/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 28 Apr 2026 19:39:39 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=oKbI7%2FF7rnN6B2MouwItM6DUzRZCHTfmcWt%2FbJe1awhe90Vd3DYioryXq6B0sG3r3NfBt%2B%2BOyYeuUBK356bIc9bwxtMF%2Fjn57IW%2FlqlaMYm4fWPW4ywbXWCj%2BdQgyqItCSyjgWIZF5I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9f3888c10bef0731-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"99914b932bd37a50b983c5e7c90ae93b","sha1":"bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","sha512":"27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd","ssdeep":"","tlshash":"c7100000000000c00000000c00000000000000000c0000000000000000000000000000","first_seen":"2023-03-07T01:15:26Z","last_seen":"2026-08-09T05:47:14.661328Z","times_seen":757561,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"phantom-6uw.pages.dev/","fqdn":"phantom-6uw.pages.dev","domain":"phantom-6uw.pages.dev","tld":"pages.dev"},"ip":{"addr":"172.66.47.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-28T19:39:38.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"phantom-6uw.pages.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 16 Apr 2026 06:03:26 GMT","end":"Wed, 15 Jul 2026 07:02:08 GMT"},"fingerprint":{"sha1":"0C:87:91:93:6C:A1:13:DE:2F:CC:48:2E:28:D3:6B:0E:C5:6A:2B:C7","sha256":"64:52:F9:88:ED:EE:61:05:6B:CE:CF:28:E8:B0:B3:C1:7E:6C:73:CE:AD:A9:11:20:D1:FE:11:81:0E:EC:1D:93"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: phantom-6uw.pages.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 28 Apr 2026 19:39:38 GMT\r\ncontent-type: text/html;charset=utf-8\r\ncache-control: no-cache, no-store, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qdlCEbT0XepmYSSS9EIfpcqmJRB3uED9NH2CW1GDdsqY4DOMMw8dEBLZfLCz127TINphFVtUUXJ1LfdG1pKXXW262g3lqRldh%2B96o5slRjr9jQMCHLsJGKCCZgMyaaUd4Ye5CwOp9nk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9f3888bd8fcf712e-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30643,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1256)","md5":"5c5639372bab6e722588ec226cc6bd6f","sha1":"20e9c83a5253c817925a1f0bd92d3ebe230a7aae","sha256":"3e0285d4134bfc35e77d4a8b658f832d1fdd9a6fd043d37bb0e1e7c6d17f46d5","sha512":"ca28e48988af107ef0d5410a75333ae5509b5c02c54f898a49cf15df31fe7b755a56319f3095e0aaaadb4267eaaf9285fa2258cc6bb6931cb64b7f4d91284f4d","ssdeep":"192:9/ivKFMSX4Bb+huyPfCAS0oMF6wIM2OwclvlR6togZ2jPh+++aCqIaCKjISXAzXV:9KvE4EE7W7yNyAzARy5xSsdxwPBzf3cr","tlshash":"05d2f97739634815858ba4eaa37b870632748213d902d89dfadc47e4cfc4e9cd537aac","first_seen":"2026-04-28T19:40:01.905044Z","last_seen":"2026-04-28T19:40:01.905044Z","times_seen":1,"resource_available":false,"data":null}},"time_used":388,"timings":{"blocked":31,"dns":8,"connect":1,"send":0,"wait":319,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}