{"report_id":"a297ee14-f84d-42ae-a068-e0d8c326bc32","version":0,"status":"done","tags":[],"date":"2026-07-17T08:49:01Z","url":{"schema":"http","addr":"hvflexo.com","fqdn":"hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":0,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"title":"Access your document","dom":{"size":5550,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"c2d8cf1fa31d4457d693cea920aa075b","sha1":"c5c96605a343a5245216808d2f5a59bb83a99b8c","sha256":"e270876edf8ad9b040c5e1a403e0d33965365241279b5db3ef41f9608953e21f","sha512":"d472fb41db5d8a91bdd6cdaed89f5d2d1fa0418e1071dfa24d636407973837177d17b62742aa5036bd969190aae3d3e4339ea858a977693373db2f0b59a99648","ssdeep":"96:nkTuS3TvsQC+3bQXMoooDUc5tj8lSClK9c8Vakw+4CmsS5pelV:kFjanXwrv8Vakw+4Cml5mV","tlshash":"5db160a2b020880733229677bb17675a9483801fc953bd9878da2124cffed675db367d","dom_hash":"domhashc18c3cc5de21e424794c2db666690698","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"hvflexo.com","fqdn":"hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":0,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T08:49:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-05-21","domain_rank":0,"first_seen":"2026-07-15T03:06:48.713005Z","last_seen":"2026-07-15T03:06:48.713005Z","alert_count":18,"request_count":6,"received_data":15776,"sent_data":4048,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"hvflexo.com","ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-05-21","domain_rank":0,"first_seen":"2026-07-16T09:06:10.740802Z","last_seen":"2026-07-16T09:06:10.740802Z","alert_count":3,"request_count":1,"received_data":260,"sent_data":480,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/logo/powered_byDocu.png","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:48:34.972Z","timestamp":1784278114972,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/logo/powered_byDocu.png HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:34 GMT\r\ncontent-type: image/png\r\ncontent-length: 3607\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"6a562065-e17\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3607,"size_decoded":3831,"mime_type":"image/png","magic":"PNG image data, 190 x 39, 8-bit/color RGBA, non-interlaced","md5":"1e5b4e0ba07604bd0c3df98507a14d13","sha1":"24e2bd07fe88fd83b7614822ca951587731fe90b","sha256":"a9fc0f18a0e6a3d530c35cb01975a68e483c25a1c00a0f62821ca7d34aa9a2f1","sha512":"9296dcc1aec53b8df29ebee36b11821bb7fea84909eeda8ba8bba1e34e5a20b69a17ef0649d524533679823e6e3bb8e9a19aa4493e8d56c1520410517be911d0","ssdeep":"","tlshash":"15716ccb1f7e5e8fc649652381f805cdd334474c530250ea65a19f62d87da24a0dbac4","first_seen":"2025-12-12T16:36:11.002384Z","last_seen":"2026-07-17T08:49:01.921515Z","times_seen":96,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/icon/ds-icons-favicon-default-64x64.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:48:35.012Z","timestamp":1784278115012,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/icon/ds-icons-favicon-default-64x64.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:35 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 542\r\nx-accel-version: 0.01\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"384-65690afcd2340-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":900,"size_decoded":860,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"17a782f04369cc79f490a976243511f6","sha1":"84622e41838bdcd204ee2cfad064b4ba58d0b5d5","sha256":"500168ad65bae9fc7d865a3a98704346e4313bedfa401f50ebb24affbffb71cb","sha512":"ea715c41758d9735c22fff73cdd58cfbbecd6ef4f424e2380103d9d61e4b21a314dd51f8359211cbfc9af5dfbfb8cf20fa00b1093c8f9f34c413a43cc82ff7ce","ssdeep":"","tlshash":"9111c40a4705cdeab60c46209fb409c6137ce4ebe4bc04d876d92c66de6cde4150d7c4","first_seen":"2024-04-26T09:25:48Z","last_seen":"2026-07-28T09:49:47.53299Z","times_seen":673,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":34,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/icon/ds-icons-favicon-default-64x64.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:48:35.013Z","timestamp":1784278115013,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/icon/ds-icons-favicon-default-64x64.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:35 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 542\r\nx-accel-version: 0.01\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"384-65690afcd2340-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":900,"size_decoded":860,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"17a782f04369cc79f490a976243511f6","sha1":"84622e41838bdcd204ee2cfad064b4ba58d0b5d5","sha256":"500168ad65bae9fc7d865a3a98704346e4313bedfa401f50ebb24affbffb71cb","sha512":"ea715c41758d9735c22fff73cdd58cfbbecd6ef4f424e2380103d9d61e4b21a314dd51f8359211cbfc9af5dfbfb8cf20fa00b1093c8f9f34c413a43cc82ff7ce","ssdeep":"","tlshash":"9111c40a4705cdeab60c46209fb409c6137ce4ebe4bc04d876d92c66de6cde4150d7c4","first_seen":"2024-04-26T09:25:48Z","last_seen":"2026-07-28T09:49:47.53299Z","times_seen":673,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hvflexo.com/","fqdn":"hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:48:33.126Z","timestamp":1784278113126,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.hvflexo.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:18 GMT","end":"Mon, 12 Oct 2026 10:41:17 GMT"},"fingerprint":{"sha1":"4E:46:B1:28:13:AB:E9:C7:DC:04:A4:F7:D9:88:DA:5F:23:EE:23:E3","sha256":"6E:4C:27:F9:E5:64:20:49:93:CB:09:E3:93:5A:8B:FE:51:6C:D4:39:CD:4A:71:7C:48:85:46:CB:03:18:CE:CA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:33 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nlocation: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/\r\nvary: User-Agent\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-29T12:56:29.616141Z","times_seen":17598011,"resource_available":true,"data":null}},"time_used":849,"timings":{"blocked":-1,"dns":206,"connect":31,"send":0,"wait":566,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:48:33.986Z","timestamp":1784278113986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:34 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\nset-cookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6; path=/\r\nlocation: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nvary: User-Agent\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-29T12:56:29.616141Z","times_seen":17598011,"resource_available":true,"data":null}},"time_used":687,"timings":{"blocked":-1,"dns":57,"connect":31,"send":0,"wait":558,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:48:34.678Z","timestamp":1784278114678,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/gate.php HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:34 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 2037\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5589,"size_decoded":2354,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0e92237d87bea6b488777cac0b137eb4","sha1":"061fc57e45e5c181a077f3c46033dc305080df3c","sha256":"c246f4b6b90b50424be885e3e1e6aa68f3f5bf63cf37800b2da034c0da8f79f4","sha512":"71ad3b0966910313510bfc5573a5a359f6efe3c47444966fec0d696b75aa285af03bae41244e8598bc9f2b9b164d7aba6e2087f371b04b10578a7febd2954aa5","ssdeep":"96:aTuS3TvsQC+3bQXMoooDUc5tj8lSClK9c8Vakw+4Cmse5pel5:aFjanXwrv8Vakw+4Cm15m5","tlshash":"7eb170a2b020880733229667bb17675a5483801fc993bd9878de2124cffed665db367d","first_seen":"2026-07-17T08:49:01.923415Z","last_seen":"2026-07-17T08:49:01.923415Z","times_seen":1,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/logo/ds-logo-default.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:48:34.970Z","timestamp":1784278114970,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/logo/ds-logo-default.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=edb3f4749b07aa8adaee546904b152b6\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:48:34 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a562065-b7c\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2940,"size_decoded":1646,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"55acf27e6b517af140d1c9fb147e31e8","sha1":"fd74318612d950ae56b82776d4507a703e2745ef","sha256":"769113eed5abf2bb8e472a29d439cc73ca6bccfa82e3d8f0b36d6f7d9fd740b6","sha512":"ef85f9034de1d6f0c04e7dd24f9743d39d63d2273884c1f46f744d4514e25569f07a7e7d9dbd8f644f6ae0b80e383c91954629356bfffec06746947645008826","ssdeep":"","tlshash":"b351217cc39da3788c1e93b486319864384f52aea4d0b239fba5dcb037520dc665d4ab","first_seen":"2024-06-11T08:17:02Z","last_seen":"2026-07-28T09:49:47.527115Z","times_seen":999,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}