{"report_id":"a8c44b2c-3a3f-41a7-8ebb-0617d2035b11","version":0,"status":"done","tags":[],"date":"2026-09-03T03:36:39Z","url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/utility.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"172.66.0.96","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/utility.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"title":"e-sign","dom":{"size":302760,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65389)","md5":"e79a8cbe8ce309788400e3e40b1159c9","sha1":"d48708bd533b463fee33b31c0ddcc4b5aaecd27e","sha256":"7efe8cb8e4cfed083a37b240aad846be7bf688765482425c6590cbc86515ca1a","sha512":"19e1abe7489ef8018e60d02ed9b0cc673b4bfe54bd0f630a821a4e29c7528fe8b6dc6545451bbaaf78f5a74a074f7f5d13d9661b0daabae63ebeb2c4b99a0ce0","ssdeep":"6144:6Edo2Cp6Edo2Cp9UNuO+L6qFnxw7Ap27rpZio6:6Edo2Cp6Edo2Cp9UNuODqFnqkp27rpZC","tlshash":"3a54123157813dbb583cca8c71d13e842ed8decfc6b8524535f5a0e282ee752adb1259","dom_hash":"domhasha54d4d55d051a5234c8cada3651a2beb","first_seen":"2026-09-03T00:15:42.295132Z","last_seen":"2026-09-03T03:36:54.919829Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/utility.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"172.66.0.96","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-08T03:36:39Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2020-06-01","domain_rank":0,"first_seen":"2026-08-31T11:48:21.144893Z","last_seen":"2026-08-31T11:48:21.144893Z","alert_count":4,"request_count":2,"received_data":304215,"sent_data":1084,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/utility.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"1cbb9abdf7f115c3a8680e26926a8eff","sha1":"a1044d634b6de6472a9d233d2002d7e40a73fe59","sha256":"fa3cb0eb2843ce441c0be861e48c4f8bf8b15200c924fce53ea55214db7f9fb6","sha512":"a920ba041db6e6a01cd98b76860d4a12dc18ed5efd870937a2136050590a55af1d9f0e8d51185358498222b225a869e533202254b71f0a2d5fb72a9a02c4c0b7","ssdeep":"","tlshash":"c2d0220e38a1660028656412142e25ca703b3572200c880c7c8e5ca81f0a34e401fed3","size":215,"data":"","first_seen":"2026-06-07T08:43:53.634316Z","last_seen":"2026-09-03T03:36:54.922012Z","times_seen":518,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/download/index.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-03T03:36:14.330Z","timestamp":1788406574330,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 26 Jul 2026 03:33:14 GMT","end":"Sat, 24 Oct 2026 04:32:58 GMT"},"fingerprint":{"sha1":"9E:8A:D3:4E:2A:56:B4:CC:A6:B6:7C:7A:16:C4:81:91:5B:7E:86:A8","sha256":"9B:74:8E:40:7F:EC:86:10:B8:79:0C:BD:E1:84:E5:25:92:60:AE:E6:0A:B0:4E:9A:2A:F5:95:CE:B0:76:CB:AA"}}},"request":{"raw":"GET /Windows/download/index.php HTTP/1.1\r\nHost: albert-dreese-esigndoc-qdtzv.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 03 Sep 2026 03:36:14 GMT\r\ncontent-type: application/vbs\r\nserver: cloudflare\r\ncontent-description: File Transfer\r\ncontent-disposition: attachment; filename=\"ScreenConnect.ClientSetup.msi\"\r\ncache-control: no-cache, must-revalidate\r\npragma: public\r\nexpires: 0\r\nx-do-app-origin: b9b5b069-b7ff-401e-8f58-06f1e61f0cde\r\nx-do-orig-status: 200\r\npriority: u=0,i\r\ncf-cache-status: BYPASS\r\nset-cookie: __cf_bm=7TKVfp0mtnoGne7WydbYSlFybiZR9UtqVO5Y3X8UQl8-1788406574.332825-1.0.1.1-bHTntNyyEE5a4sCysSMy8K7.EQcLUhtjLQ1MULHvitPtMKh3eE3PDw5N5XktaKxDZSBFfeRU7XlHaAi7AjmY3_tnViTvPgTn6bxo2dLJRiKcW5YYSO2q7jYjK4KI8RKT; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 03 Sep 2026 04:06:14 GMT\r\ncf-ray: a351b58198c656c9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"7TKVfp0mtnoGne7WydbYSlFybiZR9UtqVO5Y3X8UQl8-1788406574.332825-1.0.1.1-bHTntNyyEE5a4sCysSMy8K7.EQcLUhtjLQ1MULHvitPtMKh3eE3PDw5N5XktaKxDZSBFfeRU7XlHaAi7AjmY3_tnViTvPgTn6bxo2dLJRiKcW5YYSO2q7jYjK4KI8RKT","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-03T04:06:14Z","raw_expires":"Thu, 03 Sep 2026 04:06:14 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=7TKVfp0mtnoGne7WydbYSlFybiZR9UtqVO5Y3X8UQl8-1788406574.332825-1.0.1.1-bHTntNyyEE5a4sCysSMy8K7.EQcLUhtjLQ1MULHvitPtMKh3eE3PDw5N5XktaKxDZSBFfeRU7XlHaAi7AjmY3_tnViTvPgTn6bxo2dLJRiKcW5YYSO2q7jYjK4KI8RKT; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 03 Sep 2026 04:06:14 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":2,"size_decoded":816,"mime_type":"application/vbs","magic":"ASCII text, with CRLF line terminators","md5":"81051bcc2cf1bedf378224b0a93e2877","sha1":"ba8ab5a0280b953aa97435ff8946cbcbb2755a27","sha256":"7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6","sha512":"1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d","ssdeep":"","tlshash":"c710000300000000000000000c30000000000000000000000000003000000000000000","first_seen":"2023-03-07T01:26:14Z","last_seen":"2026-09-03T03:36:54.920792Z","times_seen":12868,"resource_available":true,"data":null}},"time_used":694,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":653,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app/Windows/utility.php","fqdn":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","domain":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-03T03:36:10.712Z","timestamp":1788406570712,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 26 Jul 2026 03:33:14 GMT","end":"Sat, 24 Oct 2026 04:32:58 GMT"},"fingerprint":{"sha1":"9E:8A:D3:4E:2A:56:B4:CC:A6:B6:7C:7A:16:C4:81:91:5B:7E:86:A8","sha256":"9B:74:8E:40:7F:EC:86:10:B8:79:0C:BD:E1:84:E5:25:92:60:AE:E6:0A:B0:4E:9A:2A:F5:95:CE:B0:76:CB:AA"}}},"request":{"raw":"GET /Windows/utility.php HTTP/1.1\r\nHost: albert-dreese-esigndoc-qdtzv.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 03 Sep 2026 03:36:10 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nx-do-app-origin: b9b5b069-b7ff-401e-8f58-06f1e61f0cde\r\ncache-control: private\r\nx-do-orig-status: 200\r\nset-cookie: __cf_bm=MT8uStGSdJ7tvmnMeBCc2i0EQFSbsWkbSwsr7XfGopQ-1788406570.733503-1.0.1.1-T8cyoTxdVpDOM5inbK2TR2T3kGilIGdjyJUdz5Ojf_E66Zkj7jwkmyVH8D1_N4hFBFC2wCSZFwdW352zVsr0GFWqe2JNJLV_2rQQh9PO2Dr8F9CwmAVoYH35QwJwI9iR; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 03 Sep 2026 04:06:10 GMT\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a351b56b1ab21525-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"MT8uStGSdJ7tvmnMeBCc2i0EQFSbsWkbSwsr7XfGopQ-1788406570.733503-1.0.1.1-T8cyoTxdVpDOM5inbK2TR2T3kGilIGdjyJUdz5Ojf_E66Zkj7jwkmyVH8D1_N4hFBFC2wCSZFwdW352zVsr0GFWqe2JNJLV_2rQQh9PO2Dr8F9CwmAVoYH35QwJwI9iR","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-03T04:06:10Z","raw_expires":"Thu, 03 Sep 2026 04:06:10 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=MT8uStGSdJ7tvmnMeBCc2i0EQFSbsWkbSwsr7XfGopQ-1788406570.733503-1.0.1.1-T8cyoTxdVpDOM5inbK2TR2T3kGilIGdjyJUdz5Ojf_E66Zkj7jwkmyVH8D1_N4hFBFC2wCSZFwdW352zVsr0GFWqe2JNJLV_2rQQh9PO2Dr8F9CwmAVoYH35QwJwI9iR; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 03 Sep 2026 04:06:10 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":302729,"size_decoded":170943,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65396), with CRLF line terminators","md5":"60173ccbd66b32db6035c0dc60b0c730","sha1":"65e6ac593ae5fe0b38cbe0ba291a653da0af7116","sha256":"7ba8ffa4ce762a071faebdda7ce242847ebcd57341dd4516f02cbf933a0b35bb","sha512":"ef83c33cc8b54bcede8bdde9becff17aff8cd96015dba947c68d71cfba6e659af3606aa9cdabe2aeb39097df23fea77fa774a85a11898e3f106c52bad1fe7564","ssdeep":"6144:1Edo2Cp6Edo2Cp9lNuO+L6qFnxw7A+27rpZiot:1Edo2Cp6Edo2Cp9lNuODqFnqk+27rpZF","tlshash":"3b54123157813dbb583cca8c72d13e842e98decfc6b8924535f5a0e382ee751adb1259","first_seen":"2026-09-03T00:15:42.297512Z","last_seen":"2026-09-03T03:36:54.9212Z","times_seen":2,"resource_available":false,"data":null}},"time_used":166,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":148,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-03","alert":"Phishing Block","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-03","alert":"Sinkholed","trigger":"albert-dreese-esigndoc-qdtzv.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}