{"report_id":"badb52ca-de8f-49cd-a12c-5c7a60e9a055","version":0,"status":"done","tags":["microsoft","phishing","suspicious"],"date":"2026-08-13T09:31:45Z","url":{"schema":"http","addr":"sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.12.118","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize?client_id=a76f5b22-b0f9-4d89-8cb6-d144b1ca0caa\u0026redirect_uri=https%253A%252F%252Foutlook.office.com%252Fmail%252F\u0026response_type=code%2Bid_token\u0026response_mode=form_post\u0026scope=https%253A%252F%252Foutlook.office.com%252F.default%2520openid%2520profile\u0026state=PTLh6kphyMVwFWSaLzagBZuZPApJfWE8\u0026nonce=MAUTXMyAcPeCggejLatYpXaVHenICjnF\u0026code_challenge=a7Rdg7UuKnMKPmWwkRsskXHh6LAwzeD2AWQP2g51hmr\u0026code_challenge_method=S256\u0026prompt=login\u0026login_hint=\u0026domain_hint=\u0026sso_reload=true\u0026client_info=1\u0026x_client_ver=1.0.0\u0026x_client_sku=MSAL.JS\u0026x_client_cpu=x64\u0026x_client_os=Windows\u0026x_client_dm=1\u0026x_ms_lib_ver=2.0.0\u0026session_id=3cf2ac05-eb3a-44ab-90a2-811563fc486b\u0026correlation_id=efd4bd9c-d1f4-4bc2-8ed6-9d357084b7d0\u0026mscrid=yzTFsZgieH6YCepc\u0026sso_nonce=bP4LIwwbfLfZNjRrFI8fXJiaIVXzJTwC\u0026tx=cpwfZtJf0qfT2xen\u0026flowToken=1EgfvgpHoygkIBzikdsTLVA8mEIdHGHZolHhnFnj06WGPB3G9ey2Rpfgw47yvH6S\u0026canary=zBBCurGz\u0026hpgact=1800\u0026hpgid=1104\u0026pgid=DstsWebV2\u0026ctx=efTyEXp4L0Hk\u0026opid=EJIkowcT\u0026uaid=rey3CYFRF60Shh9f\u0026wctx=Hf4Po56lBxI3W2Ihttwpxuln\u0026cbcxt=SlXNty2vZjlVoLm8\u0026username=\u0026mkt=en-US\u0026lc=1033\u0026lic=1","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"title":"Sign in to your account","dom":{"size":24624,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (21974)","md5":"79fbb17ff7abdcf154e58ff8aaefe6d3","sha1":"3e30e1ef0d6c1d9af8b07060bb094e643191b19f","sha256":"03748099cd3e1c08e8ed0acaf577f009c6626bd3a71c8c3a0ff41a35796bdd3b","sha512":"578979b0032a4921066c6088ef12b9d7d1a390c911a65e4192654fa64cd07ce328459450c7691141b8fae8c385595227e5c6df735a1793d2e7eb9766552507b9","ssdeep":"768:tBvKfpxmQMq0KS38yNywzPvVycE3U53+0gmp2:DvKnmRmSsyzzPdf+mtjA","tlshash":"59b2d1b70231cdeb441ad830763197071e5541dfcee14196787f2dea27c8e62e86b9a4","dom_hash":"domhasha77bb7d5dce22b2a91807420c48ff280","first_seen":"2026-05-25T22:54:51.478783Z","last_seen":"2026-08-13T09:31:46.351406Z","times_seen":23,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.12.118","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-17T09:31:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-13","alert":"Detects file containing Telegram Bot API","trigger":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-09T22:23:43.881052Z","alert_count":0,"request_count":1,"received_data":508,"sent_data":553,"comment":"","tags":null,"fingerprints":null},{"fqdn":"api.telegram.org","ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"domain_registered":"2003-12-15","domain_rank":206724,"first_seen":"2015-06-25T10:09:00Z","last_seen":"2026-08-12T22:05:44.347543Z","alert_count":0,"request_count":1,"received_data":334,"sent_data":653,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"aadcdn.msauth.net","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2018-10-25","domain_rank":5248,"first_seen":"2018-11-19T10:50:03Z","last_seen":"2026-08-12T18:54:52.223361Z","alert_count":0,"request_count":3,"received_data":17884,"sent_data":1875,"comment":"","tags":null,"fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}]},{"fqdn":"bolt.new","ip":{"addr":"104.26.6.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-07-09","domain_rank":52588,"first_seen":"2024-09-06T16:09:14Z","last_seen":"2026-08-11T14:48:51.252259Z","alert_count":0,"request_count":1,"received_data":26387,"sent_data":509,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"challenges.cloudflare.com","ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":11393,"first_seen":"2021-10-20T05:02:03Z","last_seen":"2026-08-09T23:35:42.66987Z","alert_count":0,"request_count":1,"received_data":82950,"sent_data":513,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","ip":{"addr":"104.26.13.118","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-11-14","domain_rank":0,"first_seen":"2026-05-25T22:54:48.822973Z","last_seen":"2026-08-13T05:02:41.446026Z","alert_count":14,"request_count":3,"received_data":202005,"sent_data":1585,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.13.118","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e9ad0c353e466c8e32155293032367c","sha1":"aa55f9dd63abd1cc5fd8bf7c30b22ae20ec9c4c3","sha256":"f76f60c6da02cb3ee6a19731654c526acb2a09d0db15e2e9658cb7b4e65b28c0","sha512":"c51635124cae3566472adbeaa381bf2eb83ebf861ab78ccab085c1849ba98cca670c2c50c5fb2ac84e0bb9a58c789b37edf36bd5b9abd6098920f2369dddc1ab","ssdeep":"1536:EF8xq9zg3uWvAu4EMj2TI763DhctOLcya4wGqVjC89Ia+5tc0yaCZYUn/a+tBkGx:E2X3uWIuX1Ie9xqVj9f8lCZYUzlHjyiZ","tlshash":"c2044be870a9b666abb306f5006f5007733d1d175c0d8c61b124fdaab6b5409a1bbfec","size":182127,"data":"","first_seen":"2026-05-25T22:54:51.493338Z","last_seen":"2026-08-13T09:31:46.354814Z","times_seen":23,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-13","alert":"Detects file containing Telegram Bot API","trigger":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}},{"url":{"schema":"https","addr":"bolt.new/badge.js?s=19f319cc-4575-4070-a62b-c24bef6c161f","fqdn":"bolt.new","domain":"bolt.new","tld":"new"},"ip":{"addr":"104.26.6.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7b4d5c611cf6403ad5cbaff1f5fab98a","sha1":"5cb5df562e928015d2140a5e298d75920e27810d","sha256":"b6b1a6e348f085fa9595040ee815ce2c7a41cd227c9351ad94ba4d7c3e7e8f35","sha512":"638b47ec31a2f6977c95c1c65e2b4eff623f9d67a02bc59069c354d01960c1702a5e7e51358321b468374a1595b3721491d970f507a70feed80f0590797d4aa7","ssdeep":"768:3vKfpxmQMq0KS38yHywzPvVycE3U53+0gmpFqGg3:3vKnmRmSsyBzPdf+mtjf03","tlshash":"c6b2b0b20369e8f1842dc2357679db036da004ff8da4059b787e0c5675089f2e5aaff4","size":25687,"data":"","first_seen":"2025-12-20T01:49:00.351454Z","last_seen":"2026-08-13T09:31:46.358033Z","times_seen":163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"challenges.cloudflare.com/turnstile/v0/api.js","fqdn":"challenges.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"981422051c5de04e5afc4849b416caf5","sha1":"637f44f50d2150a35e692c8e4387fc1573a65a67","sha256":"73eae66de9d6bd075350215e7cd4c97937840a75527ae854b3235cfc8bcf328e","sha512":"e279bc957f6fe2c760c074738850c3e34af3a09071bca67b1c936736b803b781ba64639c998c11bcdb7c701c0c63d9e6b56969201a8fe39d50aec1ffa97ba8d9","ssdeep":"1536:7dNGB6f5q6VyTKGoOdtpBHJFEe9sjm85LvO0PuWpCUPg:5NJEKGpVEe9sKGCcpCUPg","tlshash":"1a833bc8729a787213d6c1b4a03f6353b3257d39984c8850e527d9653a3de878273fba","size":82465,"data":"","first_seen":"2026-08-11T09:30:56.87682Z","last_seen":"2026-08-13T17:53:07.33218Z","times_seen":4724,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"error","text":"Failed to send to Telegram:","filename":"https://sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","line_number":80,"column_number":4478}]},"http":[{"url":{"schema":"https","addr":"challenges.cloudflare.com/turnstile/v0/g/aae2b9a1c261/api.js","fqdn":"challenges.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.18.94.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.640Z","timestamp":1786613469640,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"challenges.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Jun 2026 20:15:28 GMT","end":"Mon, 14 Sep 2026 21:15:13 GMT"},"fingerprint":{"sha1":"77:27:72:42:CF:51:E8:8C:7C:3E:8C:4C:A1:F0:9A:86:96:B9:0A:16","sha256":"ED:7C:F7:38:B3:0F:00:86:32:D1:14:CE:C0:FF:CA:0E:7C:86:EE:49:51:EF:A4:4B:AA:5C:B6:7C:00:B5:3D:F3"}}},"request":{"raw":"GET /turnstile/v0/g/aae2b9a1c261/api.js HTTP/1.1\r\nHost: challenges.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\nx-content-type-options: nosniff\r\ncache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public\r\naccess-control-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\npriority: u=3,i=?0\r\netag: W/\"aae2b9a1c261-api\"\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: a2a6b4893823b4f1-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":82465,"size_decoded":27033,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"981422051c5de04e5afc4849b416caf5","sha1":"637f44f50d2150a35e692c8e4387fc1573a65a67","sha256":"73eae66de9d6bd075350215e7cd4c97937840a75527ae854b3235cfc8bcf328e","sha512":"e279bc957f6fe2c760c074738850c3e34af3a09071bca67b1c936736b803b781ba64639c998c11bcdb7c701c0c63d9e6b56969201a8fe39d50aec1ffa97ba8d9","ssdeep":"1536:7dNGB6f5q6VyTKGoOdtpBHJFEe9sjm85LvO0PuWpCUPg:5NJEKGpVEe9sKGCcpCUPg","tlshash":"1a833bc8729a787213d6c1b4a03f6353b3257d39984c8850e527d9653a3de878273fba","first_seen":"2026-08-11T09:30:56.87682Z","last_seen":"2026-08-13T17:53:07.33218Z","times_seen":4724,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.13.118","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T09:31:07.648Z","timestamp":1786613467648,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bolt.host","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 31 Jul 2026 20:30:45 GMT","end":"Thu, 29 Oct 2026 21:30:26 GMT"},"fingerprint":{"sha1":"05:1F:8E:5A:77:24:A6:C4:32:0F:73:78:4D:34:25:2B:D9:8C:55:FE","sha256":"4B:36:90:08:C3:F1:4A:44:B7:92:9B:D1:9B:95:C9:35:68:81:90:09:72:42:96:65:C9:1B:CD:35:3E:7F:C6:37"}}},"request":{"raw":"GET /common/oauth2/v2.0/authorize HTTP/1.1\r\nHost: sharepoint3883-4388eral-a8qi.bolt.host\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 09:31:08 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncf-ray: a2a6b47d180bb518-OSL\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MpreFN0xOaVOuNPbdFeVy0Bb5B%2B256HRP%2BVkdAREcBVh%2FtocwSNW4Ieu6Lgj3Z9quF5bkFUY1atIZvxpRp4h3bkEz4h0%2F9lIatipBCj1EPzh9Icd7nCifL38fcYzgtEQdT2rgHe6iPt7rIQESNQxlopWcZcHM2Dw\"}]}\r\nage: 16145\r\ncache-control: public,max-age=0,must-revalidate\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncache-status: \"Netlify Edge\"; hit; ttl=31519855\r\nx-nf-request-id: 01KZX7C32JSTPEVJ1MRRY06ZWG\r\nx-powered-by: Bolt.new\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":736,"size_decoded":1205,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"b1fd5a54f117ed080f272fb69f4a888e","sha1":"803d64e50adfb4c3389fc04a4862440af49e0ab8","sha256":"45a86d2cefbded1c036b43ced01bcd1bf37e008d50788b7906ef28a889546131","sha512":"15c06bf8e9114b1a373724fbac2526a693b6f12eca6b25ec4cb1f0b6dd63c9174671b8d5542e8dcd09b4767f975d28a27bad5f45962640f088d8ca6775d40c44","ssdeep":"","tlshash":"db01d0c36860c90203109646ad90b51c6b42e34acb84d954b5fb906d6f90bdacd8b878","first_seen":"2026-05-25T22:54:51.491087Z","last_seen":"2026-08-13T09:31:46.353315Z","times_seen":23,"resource_available":true,"data":null}},"time_used":625,"timings":{"blocked":0,"dns":34,"connect":1,"send":0,"wait":575,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.13.118","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:08.656Z","timestamp":1786613468656,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bolt.host","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 31 Jul 2026 20:30:45 GMT","end":"Thu, 29 Oct 2026 21:30:26 GMT"},"fingerprint":{"sha1":"05:1F:8E:5A:77:24:A6:C4:32:0F:73:78:4D:34:25:2B:D9:8C:55:FE","sha256":"4B:36:90:08:C3:F1:4A:44:B7:92:9B:D1:9B:95:C9:35:68:81:90:09:72:42:96:65:C9:1B:CD:35:3E:7F:C6:37"}}},"request":{"raw":"GET /assets/index-dD_7Tjeq.js HTTP/1.1\r\nHost: sharepoint3883-4388eral-a8qi.bolt.host\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncf-ray: a2a6b4831fb4b518-OSL\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 17252\r\ncache-control: public, max-age=14400, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pt%2BMGITgqAmZePHKNY%2FLS1gFDMxi1f%2F1%2FNMkZaKeUvp6DmsuxBqM1cwjtyOjjDe50O7JrX%2BSl1lxTDrCdVd2cNiooQMoZOLXQBqm0jiiX%2FyV%2B7UDFEfynCDaqFz3m6dwa8Ah3uuz%2FVB46ZgjcLU6ApQBi%2FDa92E%2F\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\ncache-status: \"Netlify Edge\"; hit; ttl=31518749\r\nx-nf-request-id: 01KZWQZDWYBTWPXYN5M4RFMKJ2\r\nx-powered-by: Bolt.new\r\netag: W/\"4f2d93cea9934d88ff8bb4e2095edcdf-ssl-df\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]}],"data":{"size":182127,"size_decoded":59036,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (37509)","md5":"2e9ad0c353e466c8e32155293032367c","sha1":"aa55f9dd63abd1cc5fd8bf7c30b22ae20ec9c4c3","sha256":"f76f60c6da02cb3ee6a19731654c526acb2a09d0db15e2e9658cb7b4e65b28c0","sha512":"c51635124cae3566472adbeaa381bf2eb83ebf861ab78ccab085c1849ba98cca670c2c50c5fb2ac84e0bb9a58c789b37edf36bd5b9abd6098920f2369dddc1ab","ssdeep":"1536:EF8xq9zg3uWvAu4EMj2TI763DhctOLcya4wGqVjC89Ia+5tc0yaCZYUn/a+tBkGx:E2X3uWIuX1Ie9xqVj9f8lCZYUzlHjyiZ","tlshash":"c2044be870a9b666abb306f5006f5007733d1d175c0d8c61b124fdaab6b5409a1bbfec","first_seen":"2026-05-25T22:54:51.493338Z","last_seen":"2026-08-13T09:31:46.354814Z","times_seen":23,"resource_available":true,"data":null}},"time_used":358,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-13","alert":"Detects file containing Telegram Bot API","trigger":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-dD_7Tjeq.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Segoe+UI:wght@300;400;600\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.054Z","timestamp":1786613469054,"http_version":"HTTP/2","security_state":"","security_info":null,"request":{"raw":"GET /css2?family=Segoe+UI:wght@300;400;600\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 400 \r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: Mon, 01 Jan 1990 00:00:00 GMT\r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"400","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.telegram.org/bot8718191841:AAGsbs-sjZPu5rdNxWu7gLyA0gnfHqErv5M/sendMessage","fqdn":"api.telegram.org","domain":"telegram.org","tld":"org"},"ip":{"addr":"149.154.166.110","port":443,"asn":62041,"as":"Telegram Messenger Inc","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.196Z","timestamp":1786613469196,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.telegram.org","organization":""},"issuer":{"commonName":"Go Daddy Secure Certificate Authority - G2","organization":"GoDaddy.com, Inc."},"validity":{"start":"Tue, 11 Nov 2025 15:14:09 GMT","end":"Sun, 13 Dec 2026 15:14:09 GMT"},"fingerprint":{"sha1":"EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41","sha256":"64:47:03:9A:C9:ED:B9:03:8C:07:6E:AA:3D:BF:75:4B:4C:C1:4E:C1:A5:8C:83:2D:3E:FD:0C:E7:F7:82:C2:71"}}},"request":{"raw":"OPTIONS /bot8718191841:AAGsbs-sjZPu5rdNxWu7gLyA0gnfHqErv5M/sendMessage HTTP/1.1\r\nHost: api.telegram.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nOrigin: https://sharepoint3883-4388eral-a8qi.bolt.host\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\nserver: nginx/1.30.1\r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\naccess-control-max-age: 86400\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, POST, OPTIONS\r\naccess-control-allow-headers: content-type\r\naccess-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"Nginx:1.30.1","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":334,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":20,"send":0,"wait":20,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/backgrounds/4_eae2dd7eb3a55636dc2d74f4fa4c386e.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.204Z","timestamp":1786613469204,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/backgrounds/4_eae2dd7eb3a55636dc2d74f4fa4c386e.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"13.107.246.53","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.620Z","timestamp":1786613469620,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aadcdn.msauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 RSA CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Thu, 04 Jun 2026 21:20:51 GMT","end":"Tue, 01 Dec 2026 21:20:51 GMT"},"fingerprint":{"sha1":"BA:65:C0:BE:5D:5D:CF:39:AE:E6:15:77:C8:67:37:70:30:91:2B:BC","sha256":"35:12:DB:E0:26:76:DB:E0:BD:CD:BF:BD:06:56:0A:FC:30:33:A4:19:F9:C7:D8:33:67:22:0A:81:C4:76:3D:D2"}}},"request":{"raw":"GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncontent-type: image/x-icon\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=31536000\r\nlast-modified: Sun, 18 Oct 2020 03:02:03 GMT\r\nx-ms-request-id: 31c284d4-501e-0028-3fe0-299d53000000\r\nx-ms-version: 2009-09-19\r\nx-ms-lease-status: unlocked\r\nx-ms-blob-type: BlockBlob\r\naccess-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding\r\naccess-control-allow-origin: *\r\nx-azure-ref: 20260813T093109Z-15fc5fb94c7mgk6whC1SVGqczs00000004hg00000000279t\r\nx-fd-int-roxy-purgeid: 0\r\nx-cache: TCP_HIT\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}],"data":{"size":17174,"size_decoded":1135,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors","md5":"12e3dac858061d088023b2bd48e2fa96","sha1":"e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","sha512":"c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01","ssdeep":"24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO","tlshash":"b772e35b1f5f4981ec4b0db80b125e80c5e49c973854dffbdb76b62888b0364ab845eb","first_seen":"2023-04-05T03:19:57Z","last_seen":"2026-08-13T17:46:01.221342Z","times_seen":171700,"resource_available":false,"data":null}},"time_used":34,"timings":{"blocked":0,"dns":0,"connect":8,"send":0,"wait":9,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sharepoint3883-4388eral-a8qi.bolt.host/assets/index-BeAZqMG6.css","fqdn":"sharepoint3883-4388eral-a8qi.bolt.host","domain":"sharepoint3883-4388eral-a8qi.bolt.host","tld":"bolt.host"},"ip":{"addr":"104.26.13.118","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:08.658Z","timestamp":1786613468658,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bolt.host","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 31 Jul 2026 20:30:45 GMT","end":"Thu, 29 Oct 2026 21:30:26 GMT"},"fingerprint":{"sha1":"05:1F:8E:5A:77:24:A6:C4:32:0F:73:78:4D:34:25:2B:D9:8C:55:FE","sha256":"4B:36:90:08:C3:F1:4A:44:B7:92:9B:D1:9B:95:C9:35:68:81:90:09:72:42:96:65:C9:1B:CD:35:3E:7F:C6:37"}}},"request":{"raw":"GET /assets/index-BeAZqMG6.css HTTP/1.1\r\nHost: sharepoint3883-4388eral-a8qi.bolt.host\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncontent-type: text/css; charset=UTF-8\r\ncf-ray: a2a6b4831fb6b518-OSL\r\ncf-cache-status: REVALIDATED\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 0\r\ncache-control: public, max-age=14400, must-revalidate\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F0N94zJnUFq1eo5uO5Lt7ZBtFCDVdG8rb5a6ypACq0db8VfM2%2BBLVs1jCjd5Nh9AWIuw%2Fp4uACmk7%2BxtAO1zaA7vlmn4i2fP7SCFOOjKwFOiO7QGSXG%2Fmqt0hIVS%2F4ZPewBPnpYM5AtfYdeLjUF2z4ZGGC3WuSHE\"}]}\r\nserver: cloudflare\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nvary: Accept-Encoding\r\ncache-status: \"Netlify Edge\"; fwd=miss; fwd-status=200; stored\r\nx-nf-request-id: 01KZWQZDXG6APG3DE5F73STYYW\r\nx-powered-by: Bolt.new\r\netag: W/\"f41a9048897cac6045140c6c2482cc03-ssl-df\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Netlify","description":"Netlify providers hosting and server-less backend services for web applications and static websites.","website":"https://www.netlify.com/","common_platform_enumeration":"","icon":"Netlify.svg","categories":["PaaS","CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16496,"size_decoded":5028,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (16495)","md5":"cae90369e16b6a3621b6112fc8544ede","sha1":"524a148aedb22d3c2b6d29a6c38a85ecaf4b88c0","sha256":"5062246c9ef8dc80d2e31b9195b86b0c7e2839f57d254dd60769cc90bc5fb49f","sha512":"3836e76b5073b24e9c6db565e63ab00a48996e83d478e02b78cf7f46ba10fa264b0fbcce567d14e4618f16c928880e1e5d7a08171150f459ea60c7e8f52b33e8","ssdeep":"192:j9JyW9JyyxwOKVsfzsf4gIiXBQWPsOb1hsfSCm:lwugI4PsOb1R","tlshash":"d772a529ab10002b7c77c1f5e5d5fa9eb226a0c1df3a5aeaf9821120d7c23f71c97604","first_seen":"2026-02-25T07:40:05.558091Z","last_seen":"2026-08-13T09:31:46.357112Z","times_seen":86,"resource_available":false,"data":null}},"time_used":388,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":388,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-13","alert":"Phishing Block","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"sharepoint3883-4388eral-a8qi.bolt.host","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"bolt.new/badge.js?s=19f319cc-4575-4070-a62b-c24bef6c161f","fqdn":"bolt.new","domain":"bolt.new","tld":"new"},"ip":{"addr":"104.26.6.237","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:08.660Z","timestamp":1786613468660,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bolt.new","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Jul 2026 02:55:29 GMT","end":"Tue, 06 Oct 2026 03:55:23 GMT"},"fingerprint":{"sha1":"11:15:86:8B:5B:EB:99:AA:04:9E:29:82:73:19:C1:73:8E:4C:81:4C","sha256":"63:DD:53:8F:52:49:22:9D:44:F8:DE:65:87:78:3E:B0:B0:B4:48:D6:40:D8:55:23:13:57:39:FE:9C:81:20:1A"}}},"request":{"raw":"GET /badge.js?s=19f319cc-4575-4070-a62b-c24bef6c161f HTTP/1.1\r\nHost: bolt.new\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 09:31:09 GMT\r\ncontent-type: application/javascript\r\ncf-placement: remote-LAX\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FXmlYzwVTUSCJd29c8DMAPy3yt0YcxgDguhbzac%2FE2NnwxrXGJxvsPFfoDdfqxOUnyqngeV3F%2BCePcwVHaVlGjW6aahSoWHYnDBpKydnr6iFOkGJMfk5cb2CWA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: max-age=60, public\r\ncontent-encoding: br\r\nstrict-transport-security: max-age=15552000\r\nserver: cloudflare\r\nlast-modified: Thu, 13 Aug 2026 09:31:09 GMT\r\ncf-cache-status: EXPIRED\r\nvary: accept-encoding\r\ncf-ray: a2a6b4837c397127-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25687,"size_decoded":19084,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23780)","md5":"7b4d5c611cf6403ad5cbaff1f5fab98a","sha1":"5cb5df562e928015d2140a5e298d75920e27810d","sha256":"b6b1a6e348f085fa9595040ee815ce2c7a41cd227c9351ad94ba4d7c3e7e8f35","sha512":"638b47ec31a2f6977c95c1c65e2b4eff623f9d67a02bc59069c354d01960c1702a5e7e51358321b468374a1595b3721491d970f507a70feed80f0590797d4aa7","ssdeep":"768:3vKfpxmQMq0KS38yHywzPvVycE3U53+0gmpFqGg3:3vKnmRmSsyBzPdf+mtjf03","tlshash":"c6b2b0b20369e8f1842dc2357679db036da004ff8da4059b787e0c5675089f2e5aaff4","first_seen":"2025-12-20T01:49:00.351454Z","last_seen":"2026-08-13T09:31:46.358033Z","times_seen":163,"resource_available":true,"data":null}},"time_used":744,"timings":{"blocked":-1,"dns":46,"connect":1,"send":0,"wait":686,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg","fqdn":"aadcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize","date":"2026-08-13T09:31:09.202Z","timestamp":1786613469202,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1\r\nHost: aadcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sharepoint3883-4388eral-a8qi.bolt.host/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T17:51:58.402791Z","times_seen":17874405,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}