{"report_id":"cc8abeb5-fec9-4c1b-82e9-65c1490e0e1e","version":0,"status":"done","tags":["google"],"date":"2026-07-21T00:25:36Z","url":{"schema":"http","addr":"embazados.us/cgi-bin/mail","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":0,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"title":"Sign in - Google Accounts","dom":{"size":56431,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (795)","md5":"404841402de0b166c8a167751187f377","sha1":"adbf2ddacae2dbec38c4047c60e3e5f56413f8b1","sha256":"d37bd06677d88b81062435dcc7a92548212ac7cb982108a393f36c6129ec8ba8","sha512":"2cdf0a0a2c5d63cee4323f2d49116c86d1f927cf5a592dec95a5c2447d435ccb44a77a85e00f0e125fb341085c43fcc396084f225b45876d6adb648304bd766f","ssdeep":"384:ojd4O7s22uAusIh24/7k7VCZNIIs1GPsPsIq8XaQhaVoGg4qggo2FX13T1Ky1o5A:op41225Ihzo7sNIIEGPGb/oIUBU7DMNu","tlshash":"f843b6a5a4b72476242384357bff860b33775407890aea117edc52c85fc2ba4a7b37d8","dom_hash":"domhash4281a8658b8753b3d5b36b7d9443f7b7","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"embazados.us/cgi-bin/mail","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":0,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-25T00:25:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"summary":[{"fqdn":"embazados.us","ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-04-14","domain_rank":0,"first_seen":"2026-07-21T00:25:36.172237Z","last_seen":"2026-07-21T00:25:36.172238Z","alert_count":40,"request_count":20,"received_data":61921,"sent_data":9862,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]},"javascript":{"script":null,"eval":null,"write":null,"console":[{"level":"log","text":"[AntiBot] Client score: 15/100","filename":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","line_number":1088,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:12.904Z","timestamp":1784593512904,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:12 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/handler.php","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:13.287Z","timestamp":1784593513287,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"POST /cgi-bin/mail/handler.php HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nContent-Type: application/json\r\nContent-Length: 500\r\nOrigin: https://embazados.us\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":500,"data":"{\"type\":\"visitor\",\"sessionId\":\"cdb3f7967657bbab70e1098955fdbd3d\",\"clientInfo\":{\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\",\"platform\":\"Linux x86_64\",\"language\":\"en-US\",\"languages\":\"en-US,en\",\"cookiesEnabled\":true,\"hardwareConcurrency\":8,\"timezone\":\"UTC\",\"screen\":\"1280x1024x24\",\"url\":\"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn\",\"referrer\":\"direct\",\"botScore\":15}}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:13 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":15,"size_decoded":202,"mime_type":"application/json","magic":"JSON text data","md5":"0f0479874bf6f4a7281099b15df27c27","sha1":"55a490e280d48996e564d00492437eb17faadd28","sha256":"a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288","sha512":"2c75ba98532392f27ff21ee337200edf6612b032c29d6005d66b7a974bc43f4496779c7c807a5c06a34f9dddffbf9c18647ff5c1f99cb48b113399efc3460c52","ssdeep":"","tlshash":"60600000000c00000cc00c00000c00303fff0fc0003f00c0000c00300f000c0c00c000","first_seen":"2023-04-05T03:59:49Z","last_seen":"2026-07-21T16:49:08.36846Z","times_seen":33967,"resource_available":true,"data":null}},"time_used":247,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:17.404Z","timestamp":1784593517404,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:17 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=92\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:20.405Z","timestamp":1784593520405,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:20 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=90\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-21T00:25:09.538Z","timestamp":1784593509538,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:09 GMT\r\nServer: Apache\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":56337,"size_decoded":56532,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (795)","md5":"70f78d6d27f68ca553bbaa921e01a30e","sha1":"f784f2670623017f62984018169e8c970d201e48","sha256":"0f67f789b289b893d45eaac47bd88dcf0bb217c4c46ace42cb8671d5af2da4f2","sha512":"81d7604b232a9a1b65b48c669e87d8619166d9d0868ddabed2a79d677fc85c29ff148d32cbfc65628e0c866e5e1cbafed93e8b8ac0b818f6bc1353833b964463","ssdeep":"384:ajd4O7s22uAusIh24/7k7VCrNIIylRwBPsIq8XaQcaVLGg4qggo2FX13T1Ky1o5e:ap41225Ihzo74NIIMRw1D/oIUBU7DMNs","tlshash":"dc43b6a5a4b72476242384357bff860b33775407890aea117edc52c85fc2ba4a7b37d8","first_seen":"2026-07-21T00:25:38.827033Z","last_seen":"2026-07-21T00:25:38.827033Z","times_seen":1,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:14.404Z","timestamp":1784593514404,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:14 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=94\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:15.904Z","timestamp":1784593515904,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:15 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=93\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:21.914Z","timestamp":1784593521914,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:21 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=89\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:26.414Z","timestamp":1784593526414,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:26 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=86\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:27.915Z","timestamp":1784593527915,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:27 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=85\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:29.414Z","timestamp":1784593529414,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:29 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=84\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:32.415Z","timestamp":1784593532415,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:32 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=82\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:23.414Z","timestamp":1784593523414,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:23 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=88\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:30.915Z","timestamp":1784593530915,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:30 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=83\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:33.915Z","timestamp":1784593533915,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:33 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=81\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:18.905Z","timestamp":1784593518905,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:18 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=91\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:24.914Z","timestamp":1784593524914,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:24 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=87\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-21T00:25:09.408Z","timestamp":1784593509408,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nDate: Tue, 21 Jul 2026 00:25:09 GMT\r\nServer: Apache\r\nLocation: https://embazados.us/cgi-bin/mail/\r\nContent-Length: 282\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T19:24:29.545558Z","times_seen":17429495,"resource_available":true,"data":null}},"time_used":95,"timings":{"blocked":0,"dns":4,"connect":22,"send":0,"wait":22,"receive":0,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-21T00:25:09.511Z","timestamp":1784593509511,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/ HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nDate: Tue, 21 Jul 2026 00:25:09 GMT\r\nServer: Apache\r\nLocation: /cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn\r\nContent-Length: 0\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T19:24:29.545558Z","times_seen":17429495,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}},{"url":{"schema":"https","addr":"embazados.us/cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d","fqdn":"embazados.us","domain":"embazados.us","tld":"us"},"ip":{"addr":"185.221.216.117","port":443,"asn":393960,"as":"HOST4GEEKS-LLC","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://embazados.us/cgi-bin/mail/v3/signin/identifier?_ga=2.cdb3f7967657bbab70e1098955fdbd3d\u0026authuser=0\u0026flowName=GlifWebSignIn","date":"2026-07-21T00:25:11.406Z","timestamp":1784593511406,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webdisk.embazados.us","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 05 Jul 2026 09:27:57 GMT","end":"Sat, 03 Oct 2026 09:27:56 GMT"},"fingerprint":{"sha1":"D0:53:6A:28:ED:0B:DA:89:A6:11:28:0B:C6:C4:33:B0:89:83:EC:4A","sha256":"1B:B1:F8:25:B2:40:DA:3C:06:0C:C8:D8:BA:91:5C:88:FC:A4:06:AF:44:54:B0:DB:F8:BD:48:5C:04:FE:0C:BE"}}},"request":{"raw":"GET /cgi-bin/mail/poll.php?session_id=cdb3f7967657bbab70e1098955fdbd3d HTTP/1.1\r\nHost: embazados.us\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://embazados.us/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Tue, 21 Jul 2026 00:25:11 GMT\r\nServer: Apache\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store, no-cache, must-revalidate\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: application/json\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":18,"size_decoded":289,"mime_type":"application/json","magic":"JSON text data","md5":"d71b79d95a71f12c294dc5537fcad5d4","sha1":"33cb8e7fb8ae8d24327a57d65cddd12d65c282c7","sha256":"9576c16cd17d5a59d9200c0fe43fcbe16d637108452d44a4239ec9513f70f791","sha512":"c466844dc5e33fe24385ebe0486ffa9d21c0e84692add229979690b5757d3f8c8907a87a8710ca7524715c876cbad7f3228ec5c87f2e21d523515e5a3a38d777","ssdeep":"","tlshash":"5670000000a822022000008080a8a08000a202008808800200222800a2003000000380","first_seen":"2026-07-21T00:25:38.8251Z","last_seen":"2026-07-21T00:25:38.8251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-21","alert":"Sinkholed","trigger":"embazados.us","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Google","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Google phishing","tags":["google"],"meta":null}]}}]}