{"report_id":"a5ebd2a8-cfb8-47fe-a9eb-706d237b76af","version":0,"status":"done","tags":[],"date":"2026-08-17T19:44:22Z","url":{"schema":"http","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"title":"Login","dom":{"size":5653,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (707)","md5":"4c265f71d344e0bc8fb17693cfbfbcc0","sha1":"8998dd3fec4f1a7d1e6ee814938ebb832b0ba8ba","sha256":"36e62ec18f6211188c5f45b57892c0278a8806d65c006ddd23fafe0dd674d931","sha512":"32db9bc991a44f29c2dcd10bd5c4b59ff5c040899578b9596180d3422e4a62423b02f955277d14205e4fee01fbe2221bbc0a489a68e9237a13354cf7a6585041","ssdeep":"96:j925wEeVJf6Cm67qL4BrRhdJ0GpfzvPy38TNuGRmhkD1zkLYdwdDdxVkL93qhB:j925wEAJf6Cm67qLWrjfzlzqnB","tlshash":"b2c1c7025c9def27440648d4e0b2ee0e55ece6549702ee58ebf890de7acbfc48d22589","dom_hash":"domhash1b7d04594b3831b370721a7daa8073af","first_seen":"2026-08-17T08:17:27.762675Z","last_seen":"2026-08-17T19:44:24.848227Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-21T19:44:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"watco.microsoft-notifcation.com","ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2022-01-06","domain_rank":0,"first_seen":"2026-08-17T08:17:25.52589Z","last_seen":"2026-08-17T08:17:25.52589Z","alert_count":24,"request_count":12,"received_data":3911928,"sent_data":6715,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]},{"fqdn":"files.constantcontact.com","ip":{"addr":"52.84.50.63","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1998-09-30","domain_rank":56761,"first_seen":"2017-01-30T04:49:57Z","last_seen":"2026-08-10T14:01:26.637989Z","alert_count":0,"request_count":1,"received_data":10759,"sent_data":607,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f67312bbc48f07e308d509d6e0aa5b85","sha1":"f25409abd9bd7ca6cfbe7b13a4af611199bdd594","sha256":"fcb972b352f201448806cc3dd11f78ca3c612a550406232a2b383fadcaf3949a","sha512":"ad85838ff02e3d7a6a64043c3cda8609e2d5d04c5bf5e27a2184b433d5af0f154eaf929c5e1bdd84f324ba1ef3a7ab6cffe44627573c9f56ef086ba3ce80560d","ssdeep":"","tlshash":"a270002200082028002a8022c0c2080222282a8a00008020c2e0000828c20000000822","size":20,"data":"","first_seen":"2025-04-19T12:03:28.729546Z","last_seen":"2026-08-17T19:44:24.91586Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"a248dda93f892dea54b37cd26e278533","sha1":"75f6234e85e62fb4d90672b28ba5b79d64f776b8","sha256":"7bf2b0c3d417ed3a8a59b9e590a29a94fc0dad360465a76140e65bdfa25819e0","sha512":"4f49e0ef21b6a7d1fbfd66fa55f58271855d116109a30a3cbf46810337e0aeb505f90d550f89ebdd346de22b73b809c2c8310c04aaf2588fd275a0ee05f2129b","ssdeep":"","tlshash":"476000a000300000822a220080300000220802e20200e00002b0a00228800022000880","size":16,"data":"","first_seen":"2025-04-19T12:03:28.731283Z","last_seen":"2026-08-17T19:44:24.917624Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed3519db3c9cf5b410c92aacc0f76610","sha1":"f5076d983a5fa9d8ff31cea6f0890ef06fe1bb48","sha256":"da0f2ce08f812eaf37dd32cd9b71db6f989ab2ff1be715d8214efbb298956f5a","sha512":"2bed2add4c1f7bd294d4cc9c753d15486e82f1aa3fee90e5a7e787adf9f326b10e233fd8b65281c7a21ba5ec1f954f58a6c6d0f41657d79c1f707300516ca674","ssdeep":"","tlshash":"167000232028202800aa8822c0ca0c823228aa0a0800a020c2e8088828c28000002822","size":24,"data":"","first_seen":"2025-04-19T12:03:28.73224Z","last_seen":"2026-08-17T19:44:24.920005Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"a2b048a7aaf7ea4664ecd7249340e94a","sha1":"bcfe711330540de5bf275592bbe18adfafee3382","sha256":"576fc9104e13753fa01898680369342fb18ed99a0750a59d3dbe2d7a4e8cfed2","sha512":"22eaa88aa5a9e9c840f96b8f3c727b4c9f932a51c3e5b64ed17e7841b38f5017e25c4d2384cb6f7fa7e35ef5513929aa0c4a7105147651e0e1086288b74c524f","ssdeep":"","tlshash":"3a7000aa8080202800008022cfc2880a3aa0280c20020830f08a200e20820000000822","size":25,"data":"","first_seen":"2025-04-19T12:03:28.733144Z","last_seen":"2026-08-17T19:44:24.921137Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"7e90be750f19eff0790fc6aa7258ed82","sha1":"1000939c98b095a76783b5c240a570a05d0062d4","sha256":"8fa047b08138e8cab8a0055b660276b7de188dd1b7fbe0cdffca1917cdd83cff","sha512":"eb1bd59cbea595b0e749aec1fd4c977b51f98afacdaf1ea7399b5207bab2a0efe25b112a0ff590dce185a96b45b9b1eb18684777fcc67da5aae5d1eb54cc801c","ssdeep":"","tlshash":"2d90040d400f475c1d45dcd11735cd0010104547014301004c5110055413cd3d0310c3","size":43,"data":"","first_seen":"2025-04-19T12:03:28.733942Z","last_seen":"2026-08-17T19:44:24.929739Z","times_seen":25,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9d43b64e67c4cee4527759a5c3ab5c04","sha1":"d5637c0226dd863af268e8ad29fe75febc374088","sha256":"a8929b9ac8b053696bed57aa2ddcf0400c2129ff7ed06c2cf5b247e704079256","sha512":"36d7ccb34610b42f6a4cdac16f72f7e80003cd4bc87ed27189408fc2f9a75acdfd274844d0a1104f3053c9105d54ff6645080204728cabfb782e8335df8e9bf4","ssdeep":"","tlshash":"4f80008b2200f02882208822c0c28c2b0330380acb0088a8c2b0200f20baa02000ae23","size":30,"data":"","first_seen":"2025-04-19T12:03:28.735046Z","last_seen":"2026-08-17T19:44:24.931133Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"0f6a441567a28e203e02f1155b494bce","sha1":"b329bf23e9b183b38782afe9a72a408144f4ca8f","sha256":"f149a8ad6d03a6e3c1b080dab6b7c3bf3ab8624a8c4a6d26199fbd69568f2fec","sha512":"afaab1e431afe0f28b7cd4c063e66afe3111c5e5c6328bba520b82c9324f08405f6bcd8cea1e3943ec05d8049c090f39ddf2d5220765e11fb0ac1759b0ae5a96","ssdeep":"","tlshash":"698004073144313400745411c1c504570731f4150f100054c170d005d1550004150c53","size":36,"data":"","first_seen":"2025-04-19T12:03:28.735992Z","last_seen":"2026-08-17T19:44:24.932014Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"6b76bff81321127520b65bdab1ce7143","sha1":"bbc7a8fa2839ae790b7f4d38ccba6a1e1bd3c21d","sha256":"9e06ca9b5f13ab126ea9081a370c97f66cabfd18812094b303d3584a6512fb58","sha512":"b8b54bbd3b8f1b9c25f42dc08dfa1f30b7bf39a034be3aad398fc11920599b4cbc8f04059dbe90bd54dff62cbb57e91fe5238a45f0eaee06cf14303bd3ab829c","ssdeep":"","tlshash":"858000032882a02b0028e032c0c2082b0330a80c002088a0c080008c30c008228238ae","size":27,"data":"","first_seen":"2025-04-19T12:03:28.7368Z","last_seen":"2026-08-17T19:44:24.935579Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f6de955f158946976d79e7a593d3aedc","sha1":"b7a6260660bf3576ab7ee937edcb62e56e47d5d1","sha256":"3476c99df445e9f68a23a71ff53cee65eb4f2ce47d30cba5ac0b58aed6265e1b","sha512":"31981fec0c7ffcee921889aaf13cded414dac8cf8ee164f179ae250a71b52cfbf016142cee480c4586eb07ba2e57533cad33a957557e4997453d120cc59bee15","ssdeep":"","tlshash":"bb8004131443501744155131c0c10413133c150500554550c340400c30c04415437455","size":33,"data":"","first_seen":"2025-04-19T12:03:28.737734Z","last_seen":"2026-08-17T19:44:24.936321Z","times_seen":37,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"bd5cfe97a766cb4be76ac5b6bb16792c","sha1":"5fce182a98390f45e733876e3b3b8ec827a5f627","sha256":"8c969735b731d8a22142b1c30e2fa01993f8069f58c2181c67a5e098d44dcd82","sha512":"545960c60e1ca8b84b7b2f648549d2432be701b99dd21fc3d27620e631f3af743846f7e1db373414b1b3efe19c3b22a99133299a29bfe610c3e9aabbe99f8988","ssdeep":"","tlshash":"c7900434705cf31041175c7c1c37d5045d5374101d015040314cf0500d5f514431741c","size":42,"data":"","first_seen":"2023-03-08T12:21:04Z","last_seen":"2026-08-17T19:44:24.937919Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"902dc96e01dd1daf277625ca12040a62","sha1":"5023217fb07fb23728c9650be187abafb701d2ee","sha256":"aed7c528068cbd720e20fbf954dbb2026acaf3ba932d2058b8f3a5db90fcf347","sha512":"8cdaa66e8612883fb331fc149c24b267a2006c5bf7fcaca09de11fb55672d9aeb8c5c2934aea8dc4b1037fd1aa5076a08d4f4da1ecc9692c556a1cd78cd74d96","ssdeep":"","tlshash":"eba01218f4ba63400113143014ff09059a127d9014003121011890b02919519d553984","size":86,"data":"","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.943767Z","times_seen":58,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"added35261c36622401526cb4c698134","sha1":"46aad6df22d4c3793d036fedec2544fee62f59e8","sha256":"08153c4e164740222557894a07bdd451791dd953cc2cbb42580f02b6346737cd","sha512":"bf89a96eaee60255c5dc9ed690f7fad3a4701577a6584f1ce199b7aced20bc089ca085fcbed6dfd2e3bbfd320614e4bcda464324e5b0d1ffd1aeea7d8465e289","ssdeep":"","tlshash":"c8a01214a0682520141340b0442619169a22b48404021080120461681e195010802c14","size":71,"data":"","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.94615Z","times_seen":58,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/jquery-latest.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"25721ced154b3a99e818431446d7506d","sha1":"3f1b0e9e54af1af2db2c8a639530448723462151","sha256":"ff4e4975ef403004f8fe8e59008db7ad47f54b10d84c72eb90e728d1ec9157ce","sha512":"3eac74655a1c1c24b34cb2b8a66d0685c707b4e4fa7e6673fada9f60757f96523ad2007db2bf63922aaba9213014922bce97191073c98ecab819c0bbdf550d5e","ssdeep":"1536:YbRdUgxV11T56e7evPJoHG9N5TTApILdoABzD4yff8qeLvHHEjam7pmXSBTncquT:SXrRKN5HaObnNCVqPO","tlshash":"e493e8d9b2d6716383b731b854af5107b136a8aa784c8c50f068d8e4be74e48907bf7d","size":94020,"data":"","first_seen":"2023-03-07T12:02:44Z","last_seen":"2026-08-17T19:44:24.866504Z","times_seen":1778,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/machine_click_test.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5cee8c75af2fac132060f962ed193a63","sha1":"209a10562748ecc7572f3896f00b09c071d1ab22","sha256":"44bd34f63a33def3042233065d9f21e0d8e5af001baddf263d19e3e113d90f6f","sha512":"6580f22cfe880ef66c41a0434f6c0368913f2bc4ee7f3fe1b64ace33d9e5245c6d18b976f1010288c36222640d3ff278f70b53e50165c4b35e19cba857a21cd7","ssdeep":"192:2sjTuiKxaiHSk7Tuik3aeHSPpTuiE+HS86n3TuiMpEB3EHbuOnaeHS5Y:2sFKsQdkKP3ERRp9EH3a5Y","tlshash":"6ed114c4eebb621c481a110fe9044404dda5f73d460ce026feeeeb252759d36f66d4ab","size":6158,"data":"","first_seen":"2025-04-19T12:03:28.72683Z","last_seen":"2026-08-17T19:44:24.872387Z","times_seen":31,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/crypto-sha1.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f0dba98f3140436159ce3f3d3c1ed6e","sha1":"b7284438324bf0c9c263c7a893bc3005f83a346d","sha256":"d86e052a8143180402f57be1bdeb8c53d552e30994cde0f7273b6166f124189a","sha512":"9d503dd686a950f16b7278182e964e8e8a3308bd90930ba75246762804d9e9e1ebea22e6970c7d7ac4e65365783f9ee2da7e3916df6ce9753d50a2af8528a72e","ssdeep":"","tlshash":"1351757232caf45ac37225601e7f501af4f8db13ce9e84d1d69441e49af0ebd416dea4","size":2963,"data":"","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.862505Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"domTimer","is_inline":false,"md5":"731dc187716c4afa10896b000479787e","sha1":"7dd34117629a875fdbeec5f31aeabcbd21fb9633","sha256":"9dbf3c4bb4d5685ae79d50d87b55d69f4b457834d5997b1532aedb2d96eca174","sha512":"3accca4399f6e6bd62e962424ebe407edd03c6ee35e661f40baff3b45efc155a9516fa745382e35ab120cc8313c324af61145bfc49a2fbd766100d0f5452fe9e","ssdeep":"","tlshash":"f0f00020c002a020828880bc0800000080828280c80008000088a00000880000820028","size":458,"data":"","first_seen":"2023-06-16T01:33:44Z","last_seen":"2026-08-17T19:44:24.947703Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/crypto-md5.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"80e360a3a66b8aa32506891830f63ef4","sha1":"f5babd1234c15c015822296a63ed6dd8ee03a76a","sha256":"297f94efb77daa1cec364488b7ad1ab28f7689bb48169ae2b9d9721f59630374","sha512":"337a723767e230066493be7ef7e5cf08b55b0fe74673087cc702f9d4852523878ef90ca237d8d4352b285e49e741d94535bce441a405f8ce78fa44aa55823d07","ssdeep":"96:JDKB0Ews9G3IVsIWI/abuIz9alUtxdaKaJ6x1MILIqvZi8+dFTJnBj/+kcT5cc9U:8BNnTUH9o6xLQ9dFTJnB7+kcTK+vhEpD","tlshash":"d5b12162648f5076c2774b2008ef2529f1797881756d0866f6fc66e8ec90ebe311bf74","size":5320,"data":"","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.865439Z","times_seen":59,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/default.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"eb91d6fda2dca0104ce95290f9105382","sha1":"3ca2077c7728bd9dfbccacdad85162e4ebe7dc7b","sha256":"360eade3118435ca5d70ffd0c5973498b098e8257e3d30b5bb17dbefc84e90c9","sha512":"2076144c2c6e659c0afc0fc74facc87b046a9ab20fb51c1ce6258e682007e35550c207fe634bf5c416a61ab37ea57a56000fcb01c001bac3828dbcaa7ae8e48e","ssdeep":"384:jL7fuEEGvOZHoZe53NctxRj+LlBQe2Z0oLe1RmIkOIWr:jnfuEHeVq7sCZ0oL2Rd","tlshash":"db929789ffbd3b21903c2068981d028e277c62336404de7aa9fd49987ad0a2d1676d77","size":20617,"data":"","first_seen":"2023-11-17T08:01:40Z","last_seen":"2026-08-17T19:44:24.869159Z","times_seen":56,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/favicon.ico","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:54.063Z","timestamp":1786995834063,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Mon, 17 Aug 2026 19:43:54 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nX-Powered-By: PHP/8.3.30\r\nX-Frame-Options: sameorigin\r\nContent-Length: 27\r\nKeep-Alive: timeout=45, max=998\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":27,"size_decoded":516,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"b4b9eb67e11cb2f8497df1db8b639433","sha1":"5858308b6528f5eacaf1311e0ed0c63faff8a5be","sha256":"333ccec4ffa0be6aba136fc9aa7fd8f5001e740e30390726d0d163c65c7638e4","sha512":"b9e329ac90ba7fcd935ce06037beb446ade99ebc8af8a351dac22c9a068efd427ad737f0c773bb91e790936003c7ba8809ea5454a32c8647476177958975611d","ssdeep":"","tlshash":"fb80002e000a8aae00220022a3a3800000002202ea32a8288c20cc020aa222c0080b0a","first_seen":"2023-04-11T00:07:30Z","last_seen":"2026-08-17T19:44:24.853282Z","times_seen":174,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/art.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:58.848Z","timestamp":1786995838848,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"POST /wa4d1737192/78b65c00e4993df97452c88c/art.php HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 1554\r\nOrigin: https://watco.microsoft-notifcation.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1554,"data":"plugList=%7C%2B%7Cnavigator.appCodeName%3DMozilla%7C%2B%7Cnavigator.appName%3DNetscape%7C%2B%7Cnavigator.appVersion%3D5.0+(X11)%7C%2B%7Cnavigator.cookieEnabled%3Dtrue%7C%2B%7Cnavigator.platform%3DLinux+x86_64%7C%2B%7Cnavigator.userAgent%3DMozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A134.0)+Gecko%2F20100101+Firefox%2F134.0%7C%2B%7Cnavigator.javaEnabled()%3Dfalse%7C%2B%7C%7C%2B%7C%0A\u0026cas=5000\u0026machineClickTestScore=2\u0026machineClickTestDescription=%5B%7B%22name%22%3A%22Screen+Size+(11)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22Screen+width+or+height+is+greater+than+or+equal+to+100px%22%2C%22result_data%22%3A%7B%22width%22%3A1280%2C%22height%22%3A1024%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22Screen+Color+Depth+(21)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22Screen+color+depth+or+pixel+depth+detected+is+greater+than+or+equal+to+24+bits%22%2C%22result_data%22%3A%7B%22colorDepth%22%3A24%2C%22pixelDepth%22%3A24%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22RAM+Size+(31)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22RAM+detected+is+greater+than+or+equal+to+2+GiB%22%2C%22result_data%22%3A%7B%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22Software+Renderer+(41)%22%2C%22result%22%3A%22fail%22%2C%22result_description%22%3A%22Renderer+found+in+known+software+renderer+list%3A+%5B%5C%22swiftshader%5C%22%2C%5C%22llvmpipe%5C%22%2C%5C%22virtualbox%5C%22%5D%22%2C%22result_data%22%3A%7B%22vendor%22%3A%22Mesa%22%2C%22renderer%22%3A%22llvmpipe%2C+or+similar%22%7D%2C%22score%22%3A2%7D%5D"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:58 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nX-Powered-By: PHP/8.3.30\r\nX-Frame-Options: sameorigin\r\nContent-Length: 0\r\nKeep-Alive: timeout=45, max=995\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":2691,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T22:08:08.205956Z","times_seen":17943375,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":118,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-17T19:43:52.394Z","timestamp":1786995832394,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/index.php HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:52 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nX-Powered-By: PHP/8.3.30\r\nSet-Cookie: id=1; HttpOnly\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 2006\r\nKeep-Alive: timeout=45, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":[{"name":"id","value":"1","quoted":false,"raw_expires":"","max_age":0,"secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"id=1; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5706,"size_decoded":2566,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (691), with CRLF, LF line terminators","md5":"0568e3208af47c8a0e8a1c12915c36f8","sha1":"53c2e2ce8555e31bd03fd74f4679d059725e907e","sha256":"541d4bee039b636fb9860dc355c7b5d388c68feb5a654618c4b9b2a034e74b9a","sha512":"19c1cafbd6ecfc08c53c9d8006c588149e6c6167179ae413c5c444bc04c48b14ddfc0d9bada85948fe4194962368d68549751ba405282df96d6768f869e56172","ssdeep":"96:fl25wEeVJf6Cm67qwMwrRhmlgnGvlwu+5LskMR/EHRP48zpWNkAylm9kD1zkLYdk:fl25wEAJf6Cm67qw3ruE5LshVI4kAaz0","tlshash":"8fc199126c59eb25491208e1d071ae0ea5dce4106702ff6cf6fca4dbebc5fc48d269ca","first_seen":"2026-08-17T08:17:27.78199Z","last_seen":"2026-08-17T19:44:24.85761Z","times_seen":2,"resource_available":false,"data":null}},"time_used":626,"timings":{"blocked":-1,"dns":31,"connect":107,"send":0,"wait":165,"receive":0,"ssl":323},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/crypto-sha1.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.232Z","timestamp":1786995833232,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/crypto-sha1.js HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"b93-658259b75c1e0-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 1379\r\nKeep-Alive: timeout=45, max=999\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2963,"size_decoded":1975,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (547), with CRLF, LF line terminators","md5":"3f0dba98f3140436159ce3f3d3c1ed6e","sha1":"b7284438324bf0c9c263c7a893bc3005f83a346d","sha256":"d86e052a8143180402f57be1bdeb8c53d552e30994cde0f7273b6166f124189a","sha512":"9d503dd686a950f16b7278182e964e8e8a3308bd90930ba75246762804d9e9e1ebea22e6970c7d7ac4e65365783f9ee2da7e3916df6ce9753d50a2af8528a72e","ssdeep":"","tlshash":"1351757232caf45ac37225601e7f501af4f8db13ce9e84d1d69441e49af0ebd416dea4","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.862505Z","times_seen":59,"resource_available":true,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/crypto-md5.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.234Z","timestamp":1786995833234,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/crypto-md5.js HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"14c8-658259b758f18-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 2103\r\nKeep-Alive: timeout=45, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":5320,"size_decoded":2701,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (547), with CRLF, LF line terminators","md5":"80e360a3a66b8aa32506891830f63ef4","sha1":"f5babd1234c15c015822296a63ed6dd8ee03a76a","sha256":"297f94efb77daa1cec364488b7ad1ab28f7689bb48169ae2b9d9721f59630374","sha512":"337a723767e230066493be7ef7e5cf08b55b0fe74673087cc702f9d4852523878ef90ca237d8d4352b285e49e741d94535bce441a405f8ce78fa44aa55823d07","ssdeep":"96:JDKB0Ews9G3IVsIWI/abuIz9alUtxdaKaJ6x1MILIqvZi8+dFTJnBj/+kcT5cc9U:8BNnTUH9o6xLQ9dFTJnB7+kcTK+vhEpD","tlshash":"d5b12162648f5076c2774b2008ef2529f1797881756d0866f6fc66e8ec90ebe311bf74","first_seen":"2023-03-07T12:07:18Z","last_seen":"2026-08-17T19:44:24.865439Z","times_seen":59,"resource_available":true,"data":null}},"time_used":445,"timings":{"blocked":-1,"dns":0,"connect":108,"send":0,"wait":112,"receive":0,"ssl":225},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/jquery-latest.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.235Z","timestamp":1786995833235,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/jquery-latest.js HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"16f44-658259b77e4c0-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 33274\r\nKeep-Alive: timeout=45, max=998\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":94020,"size_decoded":33873,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (32769)","md5":"25721ced154b3a99e818431446d7506d","sha1":"3f1b0e9e54af1af2db2c8a639530448723462151","sha256":"ff4e4975ef403004f8fe8e59008db7ad47f54b10d84c72eb90e728d1ec9157ce","sha512":"3eac74655a1c1c24b34cb2b8a66d0685c707b4e4fa7e6673fada9f60757f96523ad2007db2bf63922aaba9213014922bce97191073c98ecab819c0bbdf550d5e","ssdeep":"1536:YbRdUgxV11T56e7evPJoHG9N5TTApILdoABzD4yff8qeLvHHEjam7pmXSBTncquT:SXrRKN5HaObnNCVqPO","tlshash":"e493e8d9b2d6716383b731b854af5107b136a8aa784c8c50f068d8e4be74e48907bf7d","first_seen":"2023-03-07T12:02:44Z","last_seen":"2026-08-17T19:44:24.866504Z","times_seen":1778,"resource_available":true,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":0,"connect":106,"send":0,"wait":112,"receive":109,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/default.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.240Z","timestamp":1786995833240,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/default.js HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"5089-658259b762770-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 5410\r\nKeep-Alive: timeout=45, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":20617,"size_decoded":6008,"mime_type":"text/javascript","magic":"ASCII text","md5":"eb91d6fda2dca0104ce95290f9105382","sha1":"3ca2077c7728bd9dfbccacdad85162e4ebe7dc7b","sha256":"360eade3118435ca5d70ffd0c5973498b098e8257e3d30b5bb17dbefc84e90c9","sha512":"2076144c2c6e659c0afc0fc74facc87b046a9ab20fb51c1ce6258e682007e35550c207fe634bf5c416a61ab37ea57a56000fcb01c001bac3828dbcaa7ae8e48e","ssdeep":"384:jL7fuEEGvOZHoZe53NctxRj+LlBQe2Z0oLe1RmIkOIWr:jnfuEHeVq7sCZ0oL2Rd","tlshash":"db929789ffbd3b21903c2068981d028e277c62336404de7aa9fd49987ad0a2d1676d77","first_seen":"2023-11-17T08:01:40Z","last_seen":"2026-08-17T19:44:24.869159Z","times_seen":56,"resource_available":true,"data":null}},"time_used":437,"timings":{"blocked":-1,"dns":0,"connect":108,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/default.css","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.242Z","timestamp":1786995833242,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/default.css HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"d23-658259b75f890-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 911\r\nKeep-Alive: timeout=45, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3363,"size_decoded":1500,"mime_type":"text/css","magic":"ASCII text","md5":"3e9e05a9a643b4d13d97dcf56380a540","sha1":"792304d42528a37b69a76fcde64429810f39d239","sha256":"473b2cc4ba0a13aa400badf2783905ae3e943efc94c61544e0f29d922b10a0fb","sha512":"d08d64ed55a0aa90ae0a125730d556a0056ac790291692fd27867ba71f7e428758c9e852e8332465bfbf4dda32b9a0b1f4b3fb722182b2e0c33d596a7e98204e","ssdeep":"","tlshash":"0561f019df9cd418e30861692e2127b0053c88236a4b8ffaf9b62479e784cd50ba1e53","first_seen":"2023-04-11T00:07:30Z","last_seen":"2026-08-17T19:44:24.870894Z","times_seen":59,"resource_available":false,"data":null}},"time_used":440,"timings":{"blocked":-1,"dns":0,"connect":107,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/ms_background.png","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.729Z","timestamp":1786995833729,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/ms_background.png HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:45 GMT\r\nETag: \"3971e8-658259b741430\"\r\nAccept-Ranges: bytes\r\nContent-Length: 3764712\r\nX-Frame-Options: sameorigin\r\nKeep-Alive: timeout=45, max=996\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":3764712,"size_decoded":3765256,"mime_type":"image/png","magic":"PNG image data, 2556 x 1294, 8-bit/color RGBA, non-interlaced","md5":"8f7397cc65805ab6ecb11635fa948ea4","sha1":"1e392033723d24aa11861a18324058ca6ddc38c1","sha256":"9c60d90a3f335e2cf9e17eb10b65c03f95bea8bbe1ee3390a3f0c49a4200b85a","sha512":"ba9ef4f9860fcbd1d8eca131d8b67d4b66dd7baaf9a1f4e73c646e31b9a20c0f94c4f9d1841aebdf8935a80445dc5f5601eeb5467a33cbca8d8587b9f2752638","ssdeep":"24576:nDRk3hlqOP4zOARDch5c9xbZwqGjYs/EHZQJ:nDRqhIs46ARk295KqGjl/EHe","tlshash":"772533eaa9e00054cacd2ec95422670c989702703b7fede1a8bdf774e7921fb95d14c9","first_seen":"2025-08-01T14:59:25.731372Z","last_seen":"2026-08-17T19:44:24.871597Z","times_seen":14,"resource_available":false,"data":null}},"time_used":755,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":110,"receive":645,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/art.php","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.839Z","timestamp":1786995833839,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"POST /wa4d1737192/78b65c00e4993df97452c88c/art.php HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nContent-Type: application/x-www-form-urlencoded\r\nX-Requested-With: XMLHttpRequest\r\nContent-Length: 1551\r\nOrigin: https://watco.microsoft-notifcation.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":1551,"data":"plugList=%7C%2B%7Cnavigator.appCodeName%3DMozilla%7C%2B%7Cnavigator.appName%3DNetscape%7C%2B%7Cnavigator.appVersion%3D5.0+(X11)%7C%2B%7Cnavigator.cookieEnabled%3Dtrue%7C%2B%7Cnavigator.platform%3DLinux+x86_64%7C%2B%7Cnavigator.userAgent%3DMozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A134.0)+Gecko%2F20100101+Firefox%2F134.0%7C%2B%7Cnavigator.javaEnabled()%3Dfalse%7C%2B%7C%7C%2B%7C%0A\u0026cas=0\u0026machineClickTestScore=2\u0026machineClickTestDescription=%5B%7B%22name%22%3A%22Screen+Size+(11)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22Screen+width+or+height+is+greater+than+or+equal+to+100px%22%2C%22result_data%22%3A%7B%22width%22%3A1280%2C%22height%22%3A1024%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22Screen+Color+Depth+(21)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22Screen+color+depth+or+pixel+depth+detected+is+greater+than+or+equal+to+24+bits%22%2C%22result_data%22%3A%7B%22colorDepth%22%3A24%2C%22pixelDepth%22%3A24%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22RAM+Size+(31)%22%2C%22result%22%3A%22pass%22%2C%22result_description%22%3A%22RAM+detected+is+greater+than+or+equal+to+2+GiB%22%2C%22result_data%22%3A%7B%7D%2C%22score%22%3A0%7D%2C%7B%22name%22%3A%22Software+Renderer+(41)%22%2C%22result%22%3A%22fail%22%2C%22result_description%22%3A%22Renderer+found+in+known+software+renderer+list%3A+%5B%5C%22swiftshader%5C%22%2C%5C%22llvmpipe%5C%22%2C%5C%22virtualbox%5C%22%5D%22%2C%22result_data%22%3A%7B%22vendor%22%3A%22Mesa%22%2C%22renderer%22%3A%22llvmpipe%2C+or+similar%22%7D%2C%22score%22%3A2%7D%5D"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nX-Powered-By: PHP/8.3.30\r\nX-Frame-Options: sameorigin\r\nContent-Length: 0\r\nKeep-Alive: timeout=45, max=999\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP:8.3.30","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":2688,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-17T22:08:08.205956Z","times_seen":17943375,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/machine_click_test.js","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.241Z","timestamp":1786995833241,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/machine_click_test.js HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:44 GMT\r\nETag: \"180e-658259b6b9850-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 1249\r\nKeep-Alive: timeout=45, max=1000\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6158,"size_decoded":1847,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF, LF line terminators","md5":"5cee8c75af2fac132060f962ed193a63","sha1":"209a10562748ecc7572f3896f00b09c071d1ab22","sha256":"44bd34f63a33def3042233065d9f21e0d8e5af001baddf263d19e3e113d90f6f","sha512":"6580f22cfe880ef66c41a0434f6c0368913f2bc4ee7f3fe1b64ace33d9e5245c6d18b976f1010288c36222640d3ff278f70b53e50165c4b35e19cba857a21cd7","ssdeep":"192:2sjTuiKxaiHSk7Tuik3aeHSPpTuiE+HS86n3TuiMpEB3EHbuOnaeHS5Y:2sFKsQdkKP3ERRp9EH3a5Y","tlshash":"6ed114c4eebb621c481a110fe9044404dda5f73d460ce026feeeeb252759d36f66d4ab","first_seen":"2025-04-19T12:03:28.72683Z","last_seen":"2026-08-17T19:44:24.872387Z","times_seen":31,"resource_available":true,"data":null}},"time_used":431,"timings":{"blocked":-1,"dns":0,"connect":106,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/ms_login2step.css","fqdn":"watco.microsoft-notifcation.com","domain":"microsoft-notifcation.com","tld":"com"},"ip":{"addr":"3.145.232.22","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.461Z","timestamp":1786995833461,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"microsoft-notifcation.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 31 Jul 2026 10:12:41 GMT","end":"Thu, 29 Oct 2026 10:12:40 GMT"},"fingerprint":{"sha1":"F3:FD:3F:DD:40:FF:F6:C4:AA:13:DE:4F:24:B0:EA:E2:F2:02:F8:CB","sha256":"6E:EE:66:1A:D1:86:36:CE:B8:26:FE:01:37:83:F5:EE:36:F2:69:AE:8D:C8:36:05:16:E9:21:46:57:34:71:48"}}},"request":{"raw":"GET /wa4d1737192/78b65c00e4993df97452c88c/ms_login2step.css HTTP/1.1\r\nHost: watco.microsoft-notifcation.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: id=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nServer: Apache\r\nContent-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'\r\nReferrer-Policy: origin\r\nPermissions-Policy: geolocation=(self),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)\r\nLast-Modified: Mon, 03 Aug 2026 14:46:44 GMT\r\nETag: \"911-658259b6c6758-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Frame-Options: sameorigin\r\nContent-Length: 760\r\nKeep-Alive: timeout=45, max=997\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2321,"size_decoded":1348,"mime_type":"text/css","magic":"ASCII text","md5":"193d9e5d47e05e20144ce9f2506d5046","sha1":"54f06287e482e115cc0f5aa9956c5a9c18f79229","sha256":"851f26b68547b591e6fd254385f84668e75837d252e494cb7a9becd086b0040e","sha512":"842df6fabe7509f4286b7caeefd539b91a7239b497a1c8784213e1de4e976010c8796bcefb44389755353479bf2fe30d2dd8eb97cf94f70579ce3bd447b47355","ssdeep":"","tlshash":"bb41be0bfed21445b10bd4e4be76bfbb7b3c14015f1a9f343824b672d7892a62162385","first_seen":"2023-06-16T01:33:44Z","last_seen":"2026-08-17T19:44:24.883203Z","times_seen":31,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":88,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-17","alert":"Sinkholed","trigger":"watco.microsoft-notifcation.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"files.constantcontact.com/ea17bf49601/4eceece6-219c-42e1-9529-0aedb2e65950.png","fqdn":"files.constantcontact.com","domain":"constantcontact.com","tld":"com"},"ip":{"addr":"52.84.50.63","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php","date":"2026-08-17T19:43:53.474Z","timestamp":1786995833474,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"files.constantcontact.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Tue, 30 Dec 2025 00:00:00 GMT","end":"Thu, 28 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"85:EA:7C:14:37:12:4D:15:0A:A1:8D:5F:06:0C:9A:B1:45:C1:AB:EF","sha256":"04:FC:A6:D6:6C:35:AB:0F:E1:40:FE:4A:46:21:64:86:08:2A:25:AC:CF:1B:35:01:BF:3C:26:1C:87:51:2F:0F"}}},"request":{"raw":"GET /ea17bf49601/4eceece6-219c-42e1-9529-0aedb2e65950.png HTTP/1.1\r\nHost: files.constantcontact.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://watco.microsoft-notifcation.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: 10081\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nServer: AmazonS3\r\nLast-Modified: Mon, 06 May 2024 20:41:10 GMT\r\nx-amz-version-id: PMy8ZTMmSDi3JFvJPGAhmahoS_zbDM4_\r\nContent-Disposition: filename=ms logo.PNG\r\nx-amz-server-side-encryption: AES256\r\nx-amz-replication-status: FAILED\r\nDate: Mon, 17 Aug 2026 19:43:53 GMT\r\nETag: \"ff5a1beaf97ab535373628c8ba722262\"\r\nX-Cache: Hit from cloudfront\r\nVia: 1.1 bb489e045ccdb24c55a720f2ea03e7f0.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: OSL50-P3\r\nX-Amz-Cf-Id: yNPFH9DK7ekd7IRYplk5HKdkZMTdBEQilbZmiB70TxFRVk-DhXOYSw==\r\nAge: 15659\r\nX-Robots-Tag: noindex, nofollow\r\nVary: Origin\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":10081,"size_decoded":10759,"mime_type":"image/png","magic":"PNG image data, 269 x 63, 8-bit/color RGBA, non-interlaced","md5":"ff5a1beaf97ab535373628c8ba722262","sha1":"1111da5532ffc924bcf8c7659de5f7fd737c4f68","sha256":"a04298ddc376ecbfc041e7aa8ca8a4fe0f959e9e3920c328f172e2482fe10905","sha512":"c172a0b59199ec02de020ddaa3657b6947b8d002c674f94d3b13dd2b71d12b304ece90badc051ee2b4de8fe5e01034c1ff6f1c1f04062a759df254d796787d20","ssdeep":"192:peqr0WNYm0rCcvnjfbamFqxiZMn/kg23f0c634RNYmjdHWBuxTziobDGhhS9NeNQ:8qYPm0rCcv3ayqRn/kn33/Pj8QxTzbM0","tlshash":"d222bf09b14c17c8ce74362b4ed7f8e94963acc217ca43e23d90d6e5a602fb2f5d4912","first_seen":"2026-08-17T08:17:27.777945Z","last_seen":"2026-08-17T19:44:24.909507Z","times_seen":2,"resource_available":false,"data":null}},"time_used":273,"timings":{"blocked":206,"dns":27,"connect":9,"send":0,"wait":26,"receive":0,"ssl":4},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}