{"report_id":"ada5b81e-f38e-4a79-a34b-ea87e33c52a1","version":0,"status":"done","tags":[],"date":"2026-07-17T08:29:25Z","url":{"schema":"http","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":0,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"title":"Access your document","dom":{"size":5550,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"9a7dc737546b27936f96ea7663e66eca","sha1":"ca0033e5a59da75a1452ed8a1858ab100441aa19","sha256":"f46938f920859dff13f5f0cc9b1f34b19e88448eee461800bd51546bab44318a","sha512":"480eed887dfb99930e52c68cd0176c74c2384a594c1be7778f77c9996d970fcbde3d6e1d13a560a65ebc7ab5b3b4d908cb09f28c4ad67a0b33d210e9eef0445d","ssdeep":"96:nkTuS3TvsQC+3bQXMoooDUc5tj8lSClK9c8Vakw+4CDsS5pelV:kFjanXwrv8Vakw+4CDl5mV","tlshash":"98b172a2b020880733229677bb17675d5483801fca53bd9878da1124cffed665db367d","dom_hash":"domhashc18c3cc5de21e424794c2db666690698","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":0,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T08:29:25Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2026-05-21","domain_rank":0,"first_seen":"2026-07-15T03:06:48.713005Z","last_seen":"2026-07-15T03:06:48.713005Z","alert_count":15,"request_count":5,"received_data":15447,"sent_data":3452,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:28:58.549Z","timestamp":1784276938549,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/gate.php HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:28:59 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 2037\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=db973e67651c30f91853751b7592fc7b; path=/sign/; secure; HttpOnly; SameSite=Lax\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":5589,"size_decoded":2455,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"0474564fbbf784a881fa38d1a6d6d5a4","sha1":"ae844957275fe78c6584b27714dd6639bf441c87","sha256":"c5b9ace4151aea533ab3f78aeb877d79e17dcf7eedb16852d904da97dd141aba","sha512":"4d29feae320fce1af682f778b74e01f7c7bf6a52b40fa40900f6cfed9c614b19a626dd850e5427cef0c0c1feb01cf27ed12ff9315b4cbc17d0d55137bd3c8184","ssdeep":"96:aTuS3TvsQC+3bQXMoooDUc5tj8lSClK9c8Vakw+4CDse5pel5:aFjanXwrv8Vakw+4CD15m5","tlshash":"3fb171a2b020880733229677bb1767595483801fc953bd9878de1124cffed665db367d","first_seen":"2026-07-17T08:29:27.529843Z","last_seen":"2026-07-17T08:29:27.529843Z","times_seen":1,"resource_available":true,"data":null}},"time_used":842,"timings":{"blocked":-1,"dns":207,"connect":30,"send":0,"wait":560,"receive":0,"ssl":44},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/logo/ds-logo-default.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:28:59.640Z","timestamp":1784276939640,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/logo/ds-logo-default.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=db973e67651c30f91853751b7592fc7b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:28:59 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a562065-b7c\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2940,"size_decoded":1646,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"55acf27e6b517af140d1c9fb147e31e8","sha1":"fd74318612d950ae56b82776d4507a703e2745ef","sha256":"769113eed5abf2bb8e472a29d439cc73ca6bccfa82e3d8f0b36d6f7d9fd740b6","sha512":"ef85f9034de1d6f0c04e7dd24f9743d39d63d2273884c1f46f744d4514e25569f07a7e7d9dbd8f644f6ae0b80e383c91954629356bfffec06746947645008826","ssdeep":"","tlshash":"b351217cc39da3788c1e93b486319864384f52aea4d0b239fba5dcb037520dc665d4ab","first_seen":"2024-06-11T08:17:02Z","last_seen":"2026-07-26T06:29:52.677523Z","times_seen":996,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/logo/powered_byDocu.png","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:28:59.642Z","timestamp":1784276939642,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/logo/powered_byDocu.png HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=db973e67651c30f91853751b7592fc7b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:28:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 3607\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"6a562065-e17\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3607,"size_decoded":3831,"mime_type":"image/png","magic":"PNG image data, 190 x 39, 8-bit/color RGBA, non-interlaced","md5":"1e5b4e0ba07604bd0c3df98507a14d13","sha1":"24e2bd07fe88fd83b7614822ca951587731fe90b","sha256":"a9fc0f18a0e6a3d530c35cb01975a68e483c25a1c00a0f62821ca7d34aa9a2f1","sha512":"9296dcc1aec53b8df29ebee36b11821bb7fea84909eeda8ba8bba1e34e5a20b69a17ef0649d524533679823e6e3bb8e9a19aa4493e8d56c1520410517be911d0","ssdeep":"","tlshash":"15716ccb1f7e5e8fc649652381f805cdd334474c530250ea65a19f62d87da24a0dbac4","first_seen":"2025-12-12T16:36:11.002384Z","last_seen":"2026-07-17T08:49:01.921515Z","times_seen":96,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/icon/ds-icons-favicon-default-64x64.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:28:59.691Z","timestamp":1784276939691,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/icon/ds-icons-favicon-default-64x64.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=db973e67651c30f91853751b7592fc7b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:28:59 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 542\r\nx-accel-version: 0.01\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"384-65690afcd2340-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":900,"size_decoded":860,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"17a782f04369cc79f490a976243511f6","sha1":"84622e41838bdcd204ee2cfad064b4ba58d0b5d5","sha256":"500168ad65bae9fc7d865a3a98704346e4313bedfa401f50ebb24affbffb71cb","sha512":"ea715c41758d9735c22fff73cdd58cfbbecd6ef4f424e2380103d9d61e4b21a314dd51f8359211cbfc9af5dfbfb8cf20fa00b1093c8f9f34c413a43cc82ff7ce","ssdeep":"","tlshash":"9111c40a4705cdeab60c46209fb409c6137ce4ebe4bc04d876d92c66de6cde4150d7c4","first_seen":"2024-04-26T09:25:48Z","last_seen":"2026-07-23T09:16:16.678022Z","times_seen":671,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/image/icon/ds-icons-favicon-default-64x64.svg","fqdn":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","domain":"hvflexo.com","tld":"com"},"ip":{"addr":"185.211.103.92","port":443,"asn":15415,"as":"Oberberg-Online Informationssysteme GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php","date":"2026-07-17T08:28:59.695Z","timestamp":1784276939695,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Jul 2026 10:41:00 GMT","end":"Mon, 12 Oct 2026 10:40:59 GMT"},"fingerprint":{"sha1":"81:A3:F4:7D:1F:43:1A:26:6A:69:E4:BE:28:44:41:3B:59:B9:5F:97","sha256":"3E:E6:22:5F:17:76:E4:7F:4C:9F:E1:FC:89:D4:78:E2:CA:9A:43:C8:58:60:8B:EB:47:C6:2C:79:9D:CD:46:55"}}},"request":{"raw":"GET /sign/image/icon/ds-icons-favicon-default-64x64.svg HTTP/1.1\r\nHost: apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com/sign/gate.php\r\nCookie: PHPSESSID=db973e67651c30f91853751b7592fc7b\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Fri, 17 Jul 2026 08:28:59 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 542\r\nx-accel-version: 0.01\r\nlast-modified: Tue, 14 Jul 2026 11:41:25 GMT\r\netag: \"384-65690afcd2340-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding,User-Agent\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":900,"size_decoded":860,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"17a782f04369cc79f490a976243511f6","sha1":"84622e41838bdcd204ee2cfad064b4ba58d0b5d5","sha256":"500168ad65bae9fc7d865a3a98704346e4313bedfa401f50ebb24affbffb71cb","sha512":"ea715c41758d9735c22fff73cdd58cfbbecd6ef4f424e2380103d9d61e4b21a314dd51f8359211cbfc9af5dfbfb8cf20fa00b1093c8f9f34c413a43cc82ff7ce","ssdeep":"","tlshash":"9111c40a4705cdeab60c46209fb409c6137ce4ebe4bc04d876d92c66de6cde4150d7c4","first_seen":"2024-04-26T09:25:48Z","last_seen":"2026-07-23T09:16:16.678022Z","times_seen":671,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"apps.complete-docusign-pdf-solution.successful-cpsess5970449126.hvflexo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}