{"report_id":"c4a465e0-3e85-402e-a51a-26c8edbd1e54","version":6,"status":"done","tags":[],"date":"2026-01-03T13:00:13Z","url":{"schema":"http","addr":"zimbra-blue.vercel.app/","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"zimbra-blue.vercel.app/","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"title":"404: NOT_FOUND","dom":{"size":3834,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3432)","md5":"5b0b4aa31366ffbe0dfaf7d5496e6dcd","sha1":"5bee2409f2bc2169c388ec6a5f792c9730c396c6","sha256":"ccdb91fc971f256671cf058cb62d1fd7d9d4684b0118e11368310a75cc90f65f","sha512":"42063ecba0e56adfd7a844a8f56960ca0abdde2ff067696bee579b0dc6189022e7e0ca50b4638bd42405f31d2c280c8e036653437aaf875a2bfae58c84f9f0b7","ssdeep":"","tlshash":"a38193377b69211af333c89fb1c26b993000a121c1abdab9ff579f15d5ca1661e0278c","dom_hash":"domhash31a19887ab60b039e33ca13a230f9f62","first_seen":"2026-01-03T13:00:14.250558Z","last_seen":"2026-01-03T13:00:14.250558Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"zimbra-blue.vercel.app/","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-07T13:00:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"tq2tmylv9quqkoe"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"zimbra-blue.vercel.app","ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2025-10-22T00:28:32.688037Z","last_seen":"2025-10-22T00:28:32.688037Z","alert_count":9,"request_count":3,"received_data":8795,"sent_data":1433,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"zimbra-blue.vercel.app/","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-03T12:59:50.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 17:44:01 GMT","end":"Thu, 26 Mar 2026 17:44:00 GMT"},"fingerprint":{"sha1":"F0:13:B9:71:48:C8:B9:A2:32:B5:3A:66:4B:52:54:A3:2F:FB:D4:9A","sha256":"D8:79:21:64:77:21:A9:4C:0B:30:50:5C:32:33:69:3C:1D:4A:EE:9C:4C:4D:9A:34:EB:3D:4C:86:86:B8:05:08"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zimbra-blue.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 03 Jan 2026 12:59:50 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: DEPLOYMENT_NOT_FOUND\r\nx-vercel-id: arn1::9zhqp-1767445190928-d7a5ab60774e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":3783,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3412)","md5":"4cd84b05cfe6b68c291b9819d621e068","sha1":"1f9ee3a58608c034694a62bc8ec523677bab2f55","sha256":"3fcf9d074098d957628fc8cc21852e6bd72239f3a15e854e0bb439bdc0ccf775","sha512":"06b60df977e79daab3f8a5df7e366ce07cc72b643c738e7dbf8afb3bf5aacd49e4415814d41e35588b7c7f0a2b7b403262b188108d4dbeed71ca0700c63c130b","ssdeep":"","tlshash":"b77173373b29211af333c85fa1c26b993000a121d17b9ab8ff579f25d5ca1651e1278c","first_seen":"2026-01-03T13:00:14.264124Z","last_seen":"2026-01-03T13:00:14.264124Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":29,"dns":0,"connect":1,"send":0,"wait":11,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zimbra-blue.vercel.app/","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-03T12:59:51.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 17:44:01 GMT","end":"Thu, 26 Mar 2026 17:44:00 GMT"},"fingerprint":{"sha1":"F0:13:B9:71:48:C8:B9:A2:32:B5:3A:66:4B:52:54:A3:2F:FB:D4:9A","sha256":"D8:79:21:64:77:21:A9:4C:0B:30:50:5C:32:33:69:3C:1D:4A:EE:9C:4C:4D:9A:34:EB:3D:4C:86:86:B8:05:08"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: zimbra-blue.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sat, 03 Jan 2026 12:59:51 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: DEPLOYMENT_NOT_FOUND\r\nx-vercel-id: arn1::ndb84-1767445191010-88ea5afab63d\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":3783,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3412)","md5":"b84cf94b0a7f254d920f21aa4e47ffd3","sha1":"f14a4a6d85c6533266b085889f16fb59ceb4a90b","sha256":"73eeac2314fbb83374cf7d6fa7909b31c1a1408e70ce4f368627dda97f4d1a15","sha512":"94b8da47ca713f0a73f19fae21adbf9503647c84e6bd588bd6c698ab81ead82acb9f0d32ca1cbd4825dab6e1bb42ab15865bbdfa8e8788f753f45f54f45d622c","ssdeep":"","tlshash":"667162377b69211af323c85fb1c26b893010a121d17b9ab8ff579f25d9ca1651e1278c","first_seen":"2026-01-03T13:00:14.2699Z","last_seen":"2026-01-03T13:00:14.2699Z","times_seen":1,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"zimbra-blue.vercel.app/favicon.ico","fqdn":"zimbra-blue.vercel.app","domain":"zimbra-blue.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://zimbra-blue.vercel.app/","date":"2026-01-03T12:59:51.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Fri, 26 Dec 2025 17:44:01 GMT","end":"Thu, 26 Mar 2026 17:44:00 GMT"},"fingerprint":{"sha1":"F0:13:B9:71:48:C8:B9:A2:32:B5:3A:66:4B:52:54:A3:2F:FB:D4:9A","sha256":"D8:79:21:64:77:21:A9:4C:0B:30:50:5C:32:33:69:3C:1D:4A:EE:9C:4C:4D:9A:34:EB:3D:4C:86:86:B8:05:08"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: zimbra-blue.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://zimbra-blue.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain; charset=utf-8\r\ndate: Sat, 03 Jan 2026 12:59:51 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-error: DEPLOYMENT_NOT_FOUND\r\nx-vercel-id: arn1::ndb84-1767445191086-7c7e788700ea\r\ncontent-length: 107\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":107,"size_decoded":0,"mime_type":"text/plain; charset=utf-8","magic":"ASCII text","md5":"d14df2896b5398fe44147e488b9e1ba8","sha1":"9c231a2eb629f3d125ad79b91dc2ae8318614125","sha256":"8cb790abefded7076fdaac3afeae03a8dde703a49eefc7529d40709320d93153","sha512":"0f1bfff4b299ea22255e543d0f66ccf86211833f29dda424d5e39fc9e4500837537644333a68ddc44993d30599039c3161d0d79d4176bd63d8b9b8ecc778de1a","ssdeep":"","tlshash":"c4b0121f54ce1f5834c5901178433a6ff7489361fa38f551d6cea66d3800bf6b74a0a2","first_seen":"2026-01-03T13:00:14.274114Z","last_seen":"2026-01-03T13:00:14.274114Z","times_seen":1,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-03","alert":"Sinkholed","trigger":"zimbra-blue.vercel.app","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}