{"report_id":"9e41b695-2562-4f21-be3b-b03644a06cf8","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-08-04T16:36:54Z","url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"title":"Mail","dom":{"size":6273,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8dcf097b4f09114dcbb0d4cb6223a1d3","sha1":"b12503fa822f1e415e1037d9ab712f9d1fbaac93","sha256":"5f14d70364f6c3aad98d3b6d02971f0af19dfcddd01caa70a6e9ffb3616382a6","sha512":"a3ca15d59a1defa74010888a1654dfb5a1834614849887eb0e58086897d5bceeec6c96e4c09ac424156b6f4a3e3abd08ef261dc77403b351df22b92b8e9bd41e","ssdeep":"192:Brl/+rNFMEFpF/9OAjAzFiLi3iebUnUn2iQuriyu4/:Br6FMEFpF+FiLi3i0UnpiQ6iyb","tlshash":"48d1559b15630850a6a3e1fc37eba7053160c013ae4ac8647f5ca79c8f4ad96d8b33cd","dom_hash":"domhash0fb6f10af3eb03b8bae4c81b93888c17","first_seen":"2026-08-04T16:37:04.17882Z","last_seen":"2026-08-04T16:37:04.17882Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":0,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-08T16:36:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-04","alert":"Phishing Block","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","ip":{"addr":"34.98.124.135","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"domain_registered":"2022-01-14","domain_rank":0,"first_seen":"2026-08-04T16:36:54.842594Z","last_seen":"2026-08-04T16:36:54.842594Z","alert_count":7,"request_count":2,"received_data":9662,"sent_data":1249,"comment":"","tags":null,"fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"md5":"6fd178c909d150f7c66c4bf7140c3bfb","sha1":"c11522622f921fed5069922143ea998642810f19","sha256":"b5b2ed7673bee1b9b6fb8ad1e001780d5b2ba387fd16eca3f050d1d14a90b4cf","sha512":"586053ebc171b03308c8c3c503525cbcb8f6674d847a04d9edcb616598240b5fe267b4ab53b85aa56303c48fb13cfd88c6ecec3c5114adf8e42178fa1e48b2f2","size":3040,"token":"8177661721:AAEic3pteGDLSGR6FffQ2VJoA8rOTt-x4c4","is_revoked":false,"bot":{"token":"8177661721:AAEic3pteGDLSGR6FffQ2VJoA8rOTt-x4c4","user_id":"8177661721","username":"BTTS5000bot","first_name":"BTTS5000","last_name":"","chat":{"chat_id":"6766171502","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6fd178c909d150f7c66c4bf7140c3bfb","sha1":"c11522622f921fed5069922143ea998642810f19","sha256":"b5b2ed7673bee1b9b6fb8ad1e001780d5b2ba387fd16eca3f050d1d14a90b4cf","sha512":"586053ebc171b03308c8c3c503525cbcb8f6674d847a04d9edcb616598240b5fe267b4ab53b85aa56303c48fb13cfd88c6ecec3c5114adf8e42178fa1e48b2f2","ssdeep":"","tlshash":"a851219b211718a007b7a2ed324ba314716181273d85d460fe1ce26e4f26da6fcb73ce","size":3040,"data":"","first_seen":"2026-06-16T13:12:21.071348Z","last_seen":"2026-08-04T16:37:04.182284Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T16:36:27.287Z","timestamp":1785861387287,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 10:48:17 GMT","end":"Sat, 26 Sep 2026 11:44:12 GMT"},"fingerprint":{"sha1":"A7:FB:74:19:3A:73:7C:94:76:4E:C9:2A:CD:5E:F5:6A:3D:5F:6D:9D","sha256":"A9:AE:80:27:05:74:28:2B:4F:27:C3:74:F1:45:90:28:48:6C:37:F9:77:70:B4:A6:34:57:70:F0:EA:89:EF:71"}}},"request":{"raw":"GET /?monospaceUid=483725 HTTP/1.1\r\nHost: 9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-encoding: zstd\r\ncontent-security-policy: frame-ancestors 'self' https://monospace.corp.google.com https://monospace-dev.corp.google.com https://monospace-staging.corp.google.com https://monospace-autopush.corp.google.com https://msm.sandbox.google.com https://monospace.sandbox.google.com https://monospace.google.com https://idx.google.com https://idx.sandbox.google.com https://*.firebase.google.com https://*.sslproxy.corp.google.com https://*.vscode-cdn.net https://localhost.corp.google.com:10443 https://*.cloudworkstations.googleusercontent.com https://80-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev https://firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev https://8090-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev\r\ncontent-type: text/html\r\ncross-origin-opener-policy: same-origin\r\ndate: Tue, 04 Aug 2026 16:36:27 GMT\r\nlast-modified: Tue, 16 Jun 2026 06:38:01 GMT\r\norigin-agent-cluster: ?1\r\nserver: nginx/1.26.3\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6281,"size_decoded":3672,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"ff7cd8e9be72773e28dbab049c338b2c","sha1":"578639a5b6b359d993c7187eb9300ef5ed604a67","sha256":"1d36a24616ecd1e59a966bd525cd9a13e3759efb5809acb15fbba71befe045c7","sha512":"2fb438e7cc58b7977dd5a7de3dab3c8df4100178d7b0c5eb95e4f0ff392d679dec2e218208485e9126c37213b755e508b95f5267c3d8d8b4d6bd4a0c3340bbc1","ssdeep":"192:Ll/+rNFMEFpF/9OAjwzFiLi3iebUnUn2iQuriyu4Vz:L6FMEFpFuFiLi3i0UnpiQ6iyp","tlshash":"24d1559b1567085066a3e1fc3be767053160c013ae8ac8647f5ca79d8f4ad96e8b33cd","first_seen":"2026-06-16T13:12:21.069454Z","last_seen":"2026-08-04T16:37:04.180679Z","times_seen":4,"resource_available":false,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":74,"connect":14,"send":0,"wait":160,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-04","alert":"Phishing Block","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/favicon.ico","fqdn":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","domain":"cloudworkstations.dev","tld":"dev"},"ip":{"addr":"34.98.124.135","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725","date":"2026-08-04T16:36:27.767Z","timestamp":1785861387767,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","organization":""},"issuer":{"commonName":"WR3","organization":"Google Trust Services"},"validity":{"start":"Sun, 28 Jun 2026 10:48:17 GMT","end":"Sat, 26 Sep 2026 11:44:12 GMT"},"fingerprint":{"sha1":"A7:FB:74:19:3A:73:7C:94:76:4E:C9:2A:CD:5E:F5:6A:3D:5F:6D:9D","sha256":"A9:AE:80:27:05:74:28:2B:4F:27:C3:74:F1:45:90:28:48:6C:37:F9:77:70:B4:A6:34:57:70:F0:EA:89:EF:71"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: 9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev/?monospaceUid=483725\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncontent-encoding: zstd\r\ncontent-length: 218\r\ncontent-security-policy: frame-ancestors 'self' https://80-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev https://firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev https://monospace.corp.google.com https://monospace-dev.corp.google.com https://monospace-staging.corp.google.com https://monospace-autopush.corp.google.com https://firebase-console-staging.corp.google.com https://firebase-console-ci.corp.google.com https://firebase-console-monday.corp.google.com https://firebase-console-tuesday.corp.google.com https://firebase-console-wednesday.corp.google.com https://firebase-console-thursday.corp.google.com https://firebase-console-friday.corp.google.com https://boq-fireconsole-webui-autopush.corp.google.com https://boq-fireconsole-webui-staging.corp.google.com https://boq-fireconsole-webui-daily-1.corp.google.com https://boq-fireconsole-webui-daily-2.corp.google.com https://boq-fireconsole-webui-daily-3.corp.google.com https://boq-fireconsole-webui-daily-4.corp.google.com https://boq-fireconsole-webui-daily-5.corp.google.com https://boq-fireconsole-webui.corp.google.com https://msm.sandbox.google.com https://monospace.sandbox.google.com https://idx.sandbox.google.com https://monospace.google.com https://idx.google.com https://studio.firebase.google.com https://geminicli.google.com https://*.sslproxy.corp.google.com https://*.cloudworkstations.googleusercontent.com https://localhost.corp.google.com:10443 https://localhost.corp.google.com:9990 https://localhost.corp.google.com:9900\r\ncontent-type: text/html;charset=utf-8\r\ncross-origin-opener-policy: same-origin\r\ndate: Tue, 04 Aug 2026 16:36:27 GMT\r\norigin-agent-cluster: ?1\r\nserver: nginx/1.26.3\r\nvary: Accept-Encoding\r\nvia: 1.1 google\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Google Cloud CDN","description":"Cloud CDN uses Google's global edge network to serve content closer to users.","website":"https://cloud.google.com/cdn","common_platform_enumeration":"","icon":"google-cloud-cdn.svg","categories":["CDN"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":335,"size_decoded":2115,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"a2ae3eaedf7f44998f3639756a1725cc","sha1":"2616e0e695487e0f4fc5ddc18c57dcf95ce5851a","sha256":"860b53ed6ea6a0cf602fae632cfcd28dbcf637f85a8bee28d2ee9c6cc9081669","sha512":"e950a920950fde6d4786cf81516355080821cca1d59253cb46b829f99f1aed7ff2e1618c93664801f441258923199b275d8b853baa3b657861cc238f31da9391","ssdeep":"","tlshash":"2fe0728b82f20a530291002007e0b7801c0a270f0acaa22ab68d732a5fc0181c8872d8","first_seen":"2023-05-19T23:07:51Z","last_seen":"2026-08-04T16:37:04.181565Z","times_seen":476,"resource_available":false,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-04","alert":"Phishing Block","trigger":"9000-firebase-jin-1781591798124.cluster-fsmcisrvfbb5cr5mvra3hr3qyg.cloudworkstations.dev","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}