{"report_id":"b770fabd-e775-4214-9136-f465be9274a3","version":6,"status":"done","tags":["spotify","phishing","music"],"date":"2025-12-17T07:55:22Z","url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":0,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"title":"Login - Spotify","dom":{"size":11258,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"6a32b816b3658607da81e7be8ec2ab09","sha1":"6bcab75fb21815cf817688e3a2cf6f7a50284e87","sha256":"3b7e722da96ddb7eb224e4233c9e118bd2d8d3c63123736abf91aa51bf888872","sha512":"43a7ccb4be3b91107e16d9ebe351a61ef8c9d9beb76218c8f01584988345c728a35c5a62db77ad5f2d65a4d88eae929ecf6665b8584d6ff0f82da9f3f01ea8d3","ssdeep":"192:RoO109jWxJ3f0vdJ+FmNxrZZChvLGvECkhnX7I:RZrF0VZZChJn0","tlshash":"5f32c7a158f029a7121390597ae7bb4f3e52d107ca8c9e147dfc42e94fc3e6d88db099","dom_hash":"domhashc2589c84360d50767577f5fa5c1d845f","first_seen":"2024-11-22T05:24:27.183422Z","last_seen":"2025-12-18T16:54:19.212974Z","times_seen":25,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":0,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-21T07:55:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]},"summary":[{"fqdn":"saskaboutiquehotel.com","ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"domain_registered":"2022-03-30","domain_rank":0,"first_seen":"2022-06-16T01:08:23Z","last_seen":"2025-12-16T17:28:47.098338Z","alert_count":30,"request_count":10,"received_data":444148,"sent_data":5752,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2025-12-15T02:16:33.877028Z","alert_count":0,"request_count":1,"received_data":35972,"sent_data":518,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]}]},{"fqdn":"cdn1.iconfinder.com","ip":{"addr":"104.20.38.6","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2004-02-23","domain_rank":518439,"first_seen":"2012-07-15T20:26:59Z","last_seen":"2025-12-16T22:06:13.280344Z","alert_count":0,"request_count":1,"received_data":15290,"sent_data":488,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.pixabay.com","ip":{"addr":"104.18.40.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2010-10-07","domain_rank":298908,"first_seen":"2017-01-29T11:20:46Z","last_seen":"2025-12-16T17:28:47.177054Z","alert_count":0,"request_count":1,"received_data":36232,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"031459d756eb340beb84549140874c35","sha1":"cbcd8f6fb9e0a6bb57be282d260b111db550041f","sha256":"0c4bd09de396d9c55ccd64c7eb5599acb38012e2bb33d81ae580cff09b809bae","sha512":"4b3bac9aca4b8d70febc9899bc208419b78bbd2274989e4bf04645ca38d9bf1e1fdc1a85ac97f41afa7fe0a96ea913b779be09c30dea85c3780c6cb27276b8ea","ssdeep":"","tlshash":"94c08ca80262002002c770155c58021d303a088b30084905ba3c42804f60eb802309c9","size":163,"data":"","first_seen":"2023-03-07T12:58:32Z","last_seen":"2026-05-21T22:17:01.376431Z","times_seen":382,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"2872d13e06ff6fb7fa1cb284ee8d6e2b","sha1":"0972ed7182029fe8ba5c35c2cc17a57e3abecfc9","sha256":"7111a25af1b2a074671c35833833e81085b99a528a3bb011b9288f429a93b391","sha512":"4edc0fcd33f5dedf02f397df512ae906e90ea998c0434528a2cab6cc09441480e328c69202d79938e17dbcf185188dcb97e8c4d69d4c2a61da329bca920cc541","ssdeep":"","tlshash":"f5f0e56eb9e664f00237b1291faffa1438730087a488ce047f9c0f891fa541c4656b9a","size":570,"data":"","first_seen":"2023-12-07T01:39:08Z","last_seen":"2026-05-06T19:08:26.689115Z","times_seen":291,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"dd1983aaa805a856cfdb8762651dbfba","sha1":"8f64d7a365e2587185fc8e7fc799d0b54d164cc1","sha256":"40ae8066d1696bf8abd6db6eae13b27b6dc75709b5e8da25f9eb2e0674f50e1b","sha512":"6af09313925344c0a05b2de337140117664b1a00b0c560b24f2c1a59021e2bf7af80979102a8432233a8e679757e272b9e71d50b76fb7fdce0208de6d2cf1ed1","ssdeep":"","tlshash":"f4f02bb9a25a24f11e8f666f73e7414074e044a22c448516394c091e1fa0d6b3caa2d0","size":552,"data":"","first_seen":"2024-05-30T02:57:55Z","last_seen":"2025-12-18T16:54:19.216768Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-17T07:55:00.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/login.php HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nset-cookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: gzip\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}],"data":{"size":11258,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"6a32b816b3658607da81e7be8ec2ab09","sha1":"6bcab75fb21815cf817688e3a2cf6f7a50284e87","sha256":"3b7e722da96ddb7eb224e4233c9e118bd2d8d3c63123736abf91aa51bf888872","sha512":"43a7ccb4be3b91107e16d9ebe351a61ef8c9d9beb76218c8f01584988345c728a35c5a62db77ad5f2d65a4d88eae929ecf6665b8584d6ff0f82da9f3f01ea8d3","ssdeep":"192:RoO109jWxJ3f0vdJ+FmNxrZZChvLGvECkhnX7I:RZrF0VZZChJn0","tlshash":"5f32c7a158f029a7121390597ae7bb4f3e52d107ca8c9e147dfc42e94fc3e6d88db099","first_seen":"2024-11-22T05:24:27.183422Z","last_seen":"2025-12-18T16:54:19.212974Z","times_seen":25,"resource_available":true,"data":null}},"time_used":646,"timings":{"blocked":198,"dns":1,"connect":94,"send":0,"wait":246,"receive":0,"ssl":104},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"url","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/style/react.css","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/style/react.css HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 7774\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":42856,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"be9a4676da9c3464279649b37ca215a3","sha1":"330b3c62d6b4d5fa21f16500c9f1eadca3d19872","sha256":"e9a54209a2f25283c8094474355c21b4e26e2a26f5add36f4ea8993299fdf15c","sha512":"6513077ee230d312f400981121fc2307da6e04ebd2781a9a22abc98ae5ad7480a4e3e1d3bae117c5d0820941ad2756ba16e0c5b1790fb8b8ec4d98927fa57a7e","ssdeep":"384:7qQS7odRcOBomTVN2mffZrCiqVtuDrXiGODT89KEE:7NwUomimUtGzsv","tlshash":"011354f189a3b4403886c72407fb69071bec609efda7a8fda94b26c04bb75d441d1be5","first_seen":"2024-02-12T16:34:06Z","last_seen":"2026-04-27T10:18:09.12213Z","times_seen":123,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/6/6c/Facebook_Logo_2023.png/1024px-Facebook_Logo_2023.png","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.747Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Oct 2025 07:25:45 GMT","end":"Tue, 13 Jan 2026 07:25:44 GMT"},"fingerprint":{"sha1":"4F:30:D3:13:28:19:1F:F1:40:FE:1E:F5:B4:A8:89:FD:9E:AC:EC:AD","sha256":"2E:EF:3D:23:1B:2B:63:B9:1F:1A:F1:5A:43:84:9A:6A:40:7F:00:3E:4B:E6:48:EB:EB:7B:3D:2A:90:B7:F4:7E"}}},"request":{"raw":"GET /wikipedia/commons/thumb/6/6c/Facebook_Logo_2023.png/1024px-Facebook_Logo_2023.png HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 16 Dec 2025 23:00:52 GMT\r\netag: b30459cbf94db0fdeb0aaac1e9f58ba5\r\nserver: ATS/9.2.11\r\ncontent-type: image/png\r\ncontent-disposition: inline;filename*=UTF-8''Facebook_Logo_2023.png\r\nlast-modified: Fri, 05 Dec 2025 17:50:18 GMT\r\ncontent-length: 34652\r\nage: 32048\r\naccept-ranges: bytes\r\nx-cache: cp3076 miss, cp3076 hit/33\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=PK2oMJedmdMJUUh3HAn76QLMAAAAAFvdUDMkv2tiJwHllPMrXgg0r2EgHbW2N89x;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Thu, 17 Dec 2026 00:00:00 GMT\r\nx-request-id: 3bac7507-9e19-479b-b0a7-98826db2d3b1\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]}],"data":{"size":34652,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced","md5":"b30459cbf94db0fdeb0aaac1e9f58ba5","sha1":"04a937095be32be1aa76a38312246fa2c3bedc1f","sha256":"082013f8f1eec7f486c8a023f0980cfe5181116bf8489f3da2afd1b04b748a7a","sha512":"3f5ec1b51abd630949d439831f68d62eea9392564836e59bf743bbfd23bb27be3e53edde4cc6cf2d0a4c56cdab99baa6ee1c935c822651b5f37fa45832a3607e","ssdeep":"768:7KX09anochZ72tiX5nAVlyG43Q0hMvuWq86Cvy7ZXgKAltYz:EzlCieVsZgmWq8T2XtAltY","tlshash":"cef2e0580f61d4e0c4b4e924197dab0440ef1abf44073ad4ae8c73a7aea449777ded89","first_seen":"2025-12-17T06:53:49.761024Z","last_seen":"2025-12-17T07:55:23.751388Z","times_seen":2,"resource_available":false,"data":null}},"time_used":421,"timings":{"blocked":174,"dns":128,"connect":24,"send":0,"wait":48,"receive":12,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/fonts/Avenir-Roman-12.ttf","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.937Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/fonts/Avenir-Roman-12.ttf HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/style/main.css\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 176\r\ncontent-encoding: gzip\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":234,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text","md5":"f4a6db34a1c4b2f5b85830a1d921976f","sha1":"77a91a9b55ca90aa007c012d0bf834014affedab","sha256":"ca8c089c47e2e56dfc3ff40fd5563ec7830e598d63fc7994a811083d93a906b9","sha512":"9ebf7b4d48c52ec0f166231a2b521b0f80948f4a674e3cfc893cc8bd5c6cb08f745746f66074c7590380cda2f1459c2263816b7ac4c9df7914ad74808b8f2ac0","ssdeep":"","tlshash":"71d0a7179770d363c2a31c1b7394f5ce9193a288e51a0799566341ac4cc15cf5b9869b","first_seen":"2025-12-16T17:28:48.586825Z","last_seen":"2025-12-18T16:54:19.207198Z","times_seen":6,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/fonts/Avenir-Roman-12.woff","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.883Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/fonts/Avenir-Roman-12.woff HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/style/main.css\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 234\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":234,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text","md5":"f4a6db34a1c4b2f5b85830a1d921976f","sha1":"77a91a9b55ca90aa007c012d0bf834014affedab","sha256":"ca8c089c47e2e56dfc3ff40fd5563ec7830e598d63fc7994a811083d93a906b9","sha512":"9ebf7b4d48c52ec0f166231a2b521b0f80948f4a674e3cfc893cc8bd5c6cb08f745746f66074c7590380cda2f1459c2263816b7ac4c9df7914ad74808b8f2ac0","ssdeep":"","tlshash":"71d0a7179770d363c2a31c1b7394f5ce9193a288e51a0799566341ac4cc15cf5b9869b","first_seen":"2025-12-16T17:28:48.586825Z","last_seen":"2025-12-18T16:54:19.207198Z","times_seen":6,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/img/ico/apple-touch-icon.png","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:01.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/img/ico/apple-touch-icon.png HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-length: 2620\r\ndate: Wed, 17 Dec 2025 07:55:01 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":2620,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit colormap, non-interlaced","md5":"195b9a25549ffe0dd4e716cee3746b50","sha1":"e9311e427f0f2c1af3f5e36f2b5a6b6964399686","sha256":"055610651219cf747ebc5eefbeb840db1ed5e16f5024aa6232ad104e75f54dd4","sha512":"f117106dc60c0d17f0bfee37914122af45473a04a69909b5e7e0fb93cbc7ac8aeab954f3d3f8cc1abe278f146317c7871da443331a0de18ad8fd1a69a2f23aff","ssdeep":"","tlshash":"1251f9d5eb1b8a7ecf498a35423301d12264d612faa44606cd29ae6b0630ace5b71b57","first_seen":"2024-02-12T14:39:11Z","last_seen":"2026-04-27T10:18:09.147039Z","times_seen":143,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/img/icon-loader-32@3x.png","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.741Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/img/icon-loader-32@3x.png HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-length: 4567\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":4567,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"5c1ec67a747c33801d716e24e99cec7a","sha1":"93f2b4ec97601ac84a81318d4bc937d39caad4b7","sha256":"23248741c76ca3d003122a50aacffd608d0d568c7048b296ef73a1ec1ca59c5d","sha512":"c090ebd776702a26d9599f5f662a4e24d4ec94f8928be0fc7e2fd4474707ca94f0afa52080679a26dc0103cd1d493a874ac5d4c2a8a427ee65c04f0406ca1a1d","ssdeep":"96:hs58B3/4dH6Tu/XGKwZXdDHvZQUGjAASqh8J/1/hAg6JH3VmuT:C6J4daltZ54Nnk/oVXN","tlshash":"b5917c1cf015a6aa3fdbba7700df32036ab9685619a4a01c4d0f22e999b33f505597d0","first_seen":"2023-05-18T08:06:50Z","last_seen":"2026-07-18T23:42:20.688333Z","times_seen":1712,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn1.iconfinder.com/data/icons/google-s-logo/150/Google_Icons-09-512.png","fqdn":"cdn1.iconfinder.com","domain":"iconfinder.com","tld":"com"},"ip":{"addr":"104.20.38.6","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"iconfinder.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 11 Nov 2025 18:28:12 GMT","end":"Mon, 09 Feb 2026 19:25:43 GMT"},"fingerprint":{"sha1":"D4:1B:64:13:CE:7A:E2:B7:81:A5:0E:FE:46:FC:E1:D4:49:27:43:67","sha256":"E4:52:08:23:43:EA:2E:64:A3:13:F7:39:9E:CB:24:AE:EB:B5:24:89:1A:AA:F8:0B:5A:7F:06:F5:88:4E:50:D5"}}},"request":{"raw":"GET /data/icons/google-s-logo/150/Google_Icons-09-512.png HTTP/1.1\r\nHost: cdn1.iconfinder.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 13834\r\ncf-ray: 9af4db11dc597129-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"7611770.png\"\r\ncontent-security-policy: script-src 'none'\r\nnel: {\"report_to\":\"heroku-nel\",\"response_headers\":[\"Via\"],\"max_age\":3600,\"success_fraction\":0.01,\"failure_fraction\":0.1}\r\nreport-to: {\"group\":\"heroku-nel\",\"endpoints\":[{\"url\":\"https://nel.heroku.com/reports?s=4W0tM8tk%2FWv6iJ5xDJbtil6n%2FX7aNB%2BqUF1L8711dyQ%3D\\u0026sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add\\u0026ts=1764202635\"}],\"max_age\":3600}\r\nreporting-endpoints: heroku-nel=\"https://nel.heroku.com/reports?s=4W0tM8tk%2FWv6iJ5xDJbtil6n%2FX7aNB%2BqUF1L8711dyQ%3D\u0026sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add\u0026ts=1764202635\"\r\nvia: 2.0 heroku-router\r\nx-request-id: 38f33e78-dc94-3220-8330-ab6c5101bb90\r\naccept-ranges: bytes\r\nlast-modified: Thu, 27 Nov 2025 00:17:15 GMT\r\nage: 1526729\r\nexpires: Thu, 17 Dec 2026 07:55:00 GMT\r\ncf-cache-status: HIT\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=15552000; includeSubDomains; preload\r\nx-content-type-options: nosniff\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=600\u0026min_rtt=500\u0026rtt_var=259\u0026sent=7\u0026recv=10\u0026lost=0\u0026retrans=0\u0026sent_bytes=3281\u0026recv_bytes=1250\u0026delivery_rate=7412969\u0026cwnd=254\u0026unsent_bytes=0\u0026cid=3146c0be07d6dd16\u0026ts=43\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13834,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"1d5e337897d9421dffcc7c3892a27125","sha1":"ba0125944a03ca97b1ed406352aed35dd6c674cb","sha256":"8948eafec4a9c68b2b3a78a756b4474c05e53431f208149556fb669e3c429be2","sha512":"4a1b705779e72bb0e624ff84fc77e08fdf813bde8a928f4a5ac1672a190a9482ffdb6adaf9014fb66f2025a84e23e41a82ea2c0a974dfdf797b691a7df6e639f","ssdeep":"384:S8ASM/YFUPk1rSvIs9PYtTsPOAAsj/ivUnj+Hb:r+JkgIS0oOApj/i4+","tlshash":"c852c03f4d5a616fd8b11d734ca2a45acbc7d2c80e329c6f113b06461de8e896bef910","first_seen":"2025-09-21T09:24:35.423246Z","last_seen":"2026-07-09T08:37:25.317563Z","times_seen":26,"resource_available":false,"data":null}},"time_used":106,"timings":{"blocked":35,"dns":20,"connect":3,"send":0,"wait":23,"receive":1,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/img/ico/spotico.ico","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:01.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/img/ico/spotico.ico HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nvary: Accept-Encoding\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 176\r\ncontent-encoding: gzip\r\ndate: Wed, 17 Dec 2025 07:55:01 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":234,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text","md5":"f4a6db34a1c4b2f5b85830a1d921976f","sha1":"77a91a9b55ca90aa007c012d0bf834014affedab","sha256":"ca8c089c47e2e56dfc3ff40fd5563ec7830e598d63fc7994a811083d93a906b9","sha512":"9ebf7b4d48c52ec0f166231a2b521b0f80948f4a674e3cfc893cc8bd5c6cb08f745746f66074c7590380cda2f1459c2263816b7ac4c9df7914ad74808b8f2ac0","ssdeep":"","tlshash":"71d0a7179770d363c2a31c1b7394f5ce9193a288e51a0799566341ac4cc15cf5b9869b","first_seen":"2025-12-16T17:28:48.586825Z","last_seen":"2025-12-18T16:54:19.207198Z","times_seen":6,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/style/app_styles_bundle.css","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/style/app_styles_bundle.css HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 37582\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":312046,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1129), with CRLF line terminators","md5":"c0cc09978dc6a2de493b3d889908aa01","sha1":"c94337c5203e902d91e5f5a1a29a96d25288faf7","sha256":"931b9aa1c4c314c55e8a5c99495199db4cc504894f6964b4e2347d8806165bd4","sha512":"d6c6d75de075d571f40ad19aac6700c55b14b14802fec5cd82f352f7423ebc905beecc6ff544ac410b03f710371626da355fe21c77489b3d10176c3c4e6dbdb7","ssdeep":"6144:pqQx14+28zT6cxtj4c7hgioj4bR6AadbhCQPaoMGVu1Fg4O:p7T6Ej4c7hgioj4bR6AadbhCQPaoMGV7","tlshash":"79640e1059f72721927305bea3ead00daf39c952c970528e789d3e9e0bf8315f353a99","first_seen":"2024-02-12T14:39:11Z","last_seen":"2026-04-27T10:18:09.091041Z","times_seen":110,"resource_available":false,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/style/main.css","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.735Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/style/main.css HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 3813\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22985,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"02df384f450d7ad78b88ec5fb76dd853","sha1":"460dd2170b639f1138f9163b98fa22e866e99c53","sha256":"01e01a37d4f0381dc7864c72c4882eec1093a2580ee5df5683aef9de42a55662","sha512":"d2cbd30dad3ebfba77cf3ca45ab149ee21b15294b30ec2f33b6ce41a6f6f729d5aeb6da3b13e5a5c12f3712e03ec3baca5471ddace0a7f2489cd2714d3ca008f","ssdeep":"384:4ZSTcJcOc9cKcOcnchceceSckcpCklRcBU6MsnqApZcK6cnZcP4c16cMUYFrPw+G:4ZSTcJcOc9cKcOcnchceceSckcQtcNc+","tlshash":"cfa2b5795ea324085617851d67fe93386334a057961facf97ece2548cfc02e44ae2f8e","first_seen":"2024-02-12T14:39:11Z","last_seen":"2026-04-27T10:18:09.11658Z","times_seen":129,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"saskaboutiquehotel.com/pagos/new/pattrns/Account/img/ico/logo.png","fqdn":"saskaboutiquehotel.com","domain":"saskaboutiquehotel.com","tld":"com"},"ip":{"addr":"204.93.189.117","port":443,"asn":23352,"as":"SERVERCENTRAL","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.744Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.saskaboutiquehotel.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Oct 2025 15:31:42 GMT","end":"Thu, 22 Jan 2026 15:31:41 GMT"},"fingerprint":{"sha1":"45:93:02:CE:BD:7B:A0:42:C3:2D:3A:8C:A6:AB:94:15:81:7F:7D:24","sha256":"5A:5C:E2:67:B2:1F:C6:F8:4F:0E:5C:9E:F2:29:C4:C1:3B:E4:C8:66:CF:79:2B:90:F5:53:01:6D:D7:4F:DC:0A"}}},"request":{"raw":"GET /pagos/new/pattrns/Account/img/ico/logo.png HTTP/1.1\r\nHost: saskaboutiquehotel.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php\r\nCookie: PHPSESSID=43fb38fd6868e78592eb3cba435ef9f8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncache-control: public, max-age=31557600\r\nexpires: Thu, 17 Dec 2026 13:55:00 GMT\r\ncontent-type: image/png\r\nlast-modified: Sat, 11 Jan 2025 20:46:00 GMT\r\naccept-ranges: bytes\r\ncontent-length: 43822\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\nserver: LiteSpeed\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":43822,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2362 x 708, 8-bit/color RGBA, non-interlaced","md5":"31bad8d4fc4413d54f8c19930d3739b9","sha1":"b2ca5d63d322953dba109cbc3a2430fbd4dbe803","sha256":"97a0c92b395b4a299340f3aeab3e4119023567d1a5813e6e7d02c07705a34beb","sha512":"03163808d4ef48b84ae1c7d0de9b8b1db6711e6dc94a5980823a2823d3a2ae136a447f9f2278f79bd953288134e646754da6a96e8b2396f75d414e4932b48e99","ssdeep":"768:XMrsuYJ9gs2LZSdCtl/X/1KLxeR2VllQRiPPJ09Hyq2A3KguODbGqeGq:XWsuy9gsuX/8d+KQiiSq2au27e1","tlshash":"3e13f18d64628ddcc66c41fa493b1e9d36352c85caaa2701ffb2e7bc4df498125d22d3","first_seen":"2023-05-01T16:40:41Z","last_seen":"2026-08-04T16:36:26.341706Z","times_seen":285,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"openphish","sensor_type":"Blocklist","title":"OpenPhish","description":"OpenPhish","scan_date":"2025-12-17","alert":"Phishing - Spotify","trigger":"saskaboutiquehotel.com","verdict":"phishing","severity":"medium","comment":"Spotify","link":"https://openphish.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"saskaboutiquehotel.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Spotify","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Spotify phishing","tags":["spotify","phishing","music"],"meta":null}]}},{"url":{"schema":"https","addr":"cdn.pixabay.com/photo/2022/09/11/06/01/apple-7446229_1280.png","fqdn":"cdn.pixabay.com","domain":"pixabay.com","tld":"com"},"ip":{"addr":"104.18.40.96","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://saskaboutiquehotel.com/pagos/new/pattrns/Account/login.php","date":"2025-12-17T07:55:00.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pixabay.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Nov 2025 01:12:24 GMT","end":"Wed, 18 Feb 2026 02:12:08 GMT"},"fingerprint":{"sha1":"26:CD:04:84:85:48:A5:42:51:B5:50:4B:1B:FA:EC:F0:C2:1E:FB:66","sha256":"03:E7:02:E2:20:24:4E:DF:89:A2:FB:DC:0D:3D:3F:E9:01:D2:3E:5A:EF:B7:F1:0C:42:FD:83:31:20:FC:75:E7"}}},"request":{"raw":"GET /photo/2022/09/11/06/01/apple-7446229_1280.png HTTP/1.1\r\nHost: cdn.pixabay.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://saskaboutiquehotel.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 07:55:00 GMT\r\ncontent-type: image/png\r\ncontent-length: 35010\r\nserver: cloudflare\r\ncf-ray: 9af4db11db14568d-OSL\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 9849665\r\ncache-control: public, max-age=31536000, s-maxage=31536000\r\netag: \"f179d31c50054a8218df72c20e73d7d9\"\r\nexpires: Thu, 17 Dec 2026 07:55:00 GMT\r\nlast-modified: Thu, 16 Jan 2025 15:24:55 GMT\r\nvary: Accept-Encoding\r\nx-amz-id-2: MoNuMqwFlVFu7rxkllQww0ocFMLcutL6hXRJhCtFs2OvZi+bLSKmqN1OK+ivvEt6BqfyL75a0PNi6dHuHltH46GhHoAwEpKEXHflH/DFmlA=\r\nx-amz-replication-status: FAILED\r\nx-amz-request-id: ZRDVF04KWW1AH1RN\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: Nb0kPZgFqJ.zw9xNoHOtBPmym6Sh.h3e\r\nset-cookie: __cf_bm=UqNn.8nJqLQIq9T7ay1Xqru7WCeMRKmSufUDHtgo9Sk-1765958100-1.0.1.1-MPrmQlgAnd9y0Vt1O.4O9IcdxZymIVEoTnmioxlZzy9PPHaekpEA5wZr9sQXiGEMe_BL5rUG.0GbKtF9KmzOJCwN8RL48Mw45_UGIT8gaJc; path=/; expires=Wed, 17-Dec-25 08:25:00 GMT; domain=.pixabay.com; HttpOnly; Secure; SameSite=None\n_cfuvid=dejR4Pmv5zftoyCHE8tisRxHwE8_AObUDFGvHBfvU00-1765958100803-0.0.1.1-604800000; path=/; domain=.pixabay.com; HttpOnly; Secure; SameSite=None\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":35010,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 1280, 8-bit/color RGB, non-interlaced","md5":"f179d31c50054a8218df72c20e73d7d9","sha1":"b7b6b56a83067581dadcc410b8588cc1e3585666","sha256":"acfe0700179acb11b435e0170648e148ca6db3fc5b61d75ad8c7db6bdd399add","sha512":"7e2795b476c85f60aa461700abe5daf2d254012c4b22f9cae567adabe267a3d785a2e52dc13e931ab98f9235c3f96d36cddd332ae4b88cfa80be2e7a81607f82","ssdeep":"768:1dZjZLGIdjKmLYMDYHwCatXWHZsIPdoih37pNnkrYTi0J:l8Idj3L1DEjaNWHXPvhpNnkrYTi0J","tlshash":"baf29d5f8f601fd1c42c2a392acf67192aa7472951bb826d0b54742b5d927cd3ebcc28","first_seen":"2024-05-30T02:57:56Z","last_seen":"2025-12-18T16:54:19.21175Z","times_seen":12,"resource_available":false,"data":null}},"time_used":103,"timings":{"blocked":33,"dns":20,"connect":1,"send":0,"wait":26,"receive":2,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}