{"report_id":"d7fe32fa-a166-4646-af1e-bb93947e9670","version":6,"status":"done","tags":[],"date":"2025-11-27T03:12:01Z","url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":0,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"title":"Download Microsoft Teams Desktop and Mobile Apps | Microsoft Teams","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T21:57:33.47713Z","times_seen":17844365,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":0,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-01T03:12:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":4}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-11-27T03:11:33Z","timestamp":1764213093,"ip_dst":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"ip_src":{"addr":"172.18.0.18","port":45368,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-11-27T03:11:33.680255+0000\",\"flow_id\":1951563369526144,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.18\",\"src_port\":45368,\"dest_ip\":\"64.52.80.154\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"microsoft-teams.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":921,\"bytes_toclient\":3495,\"start\":\"2025-11-27T03:11:33.373632+0000\"}}"}],"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null},"summary":[{"fqdn":"microsoft-teams.icu","ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"domain_registered":"2025-11-26","domain_rank":0,"first_seen":"2025-11-27T03:12:04.929463Z","last_seen":"2025-11-27T03:12:04.929463Z","alert_count":271,"request_count":68,"received_data":10268518,"sent_data":33126,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]}]},{"fqdn":"c.s-microsoft.com","ip":{"addr":"96.6.17.223","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2012-02-07","domain_rank":46140,"first_seen":"2013-11-06T15:56:27Z","last_seen":"2025-11-25T12:15:47.03714Z","alert_count":0,"request_count":4,"received_data":128354,"sent_data":2208,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-jquery.ACSHASH75d0cb3e9ff9fee40f5ce5fd93c17fb2.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"35986a813756f39ab6b922979ffedb03","sha1":"c8e2213bbafaf535da9c6676f3dba43449e4d15a","sha256":"e2d92bdaad925c6d355331a338384ee3ff82492352975dd4efda791aef4ab3f5","sha512":"289f1c432e73f611d54eb1130013174174222a0c5eef8e2464c5fd51ee33dc702326eeeca80b2aae213db2fccb149297fc37cc9a0b6cf6e928a66bc27843f930","ssdeep":"1536:wB4vGoYlmQr+IDv1Ty/6RsSz5TGF/46nNUgDbC03vu9FnHKDfa6Z/VUhdIKq6Tjv:wqxNrNG9FnHKD/oIKq6Tjv","tlshash":"ad9319edb6c771628ba734b850bf010bf1bb599ab04c8850f055d4e4bd74a4a50bbf2d","size":92962,"data":"","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.539793Z","times_seen":843,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"fab904f1d3872246b429b7c3c9641ce9","sha1":"1f299c9d8e248fbce4ca72406aaed3b5e470ed74","sha256":"52f8a10c4d076dded7e4cf7f1656d28ae8908eb9eb1598acc884b46fbae68f0f","sha512":"9703251339c98ec6d88e7ac3a5d2f6e54d43cb33cd722988a81a594cb5042a4d006419c4698affb59b899092bbc6f9c211acb286e2f5fefffbeed8682cee37c1","ssdeep":"","tlshash":"287000c800020202eae882082208880000a0082000808c0020882208c3a828000880c0","size":22,"data":"","first_seen":"2025-09-23T19:38:24.276779Z","last_seen":"2026-04-15T17:41:59.547364Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-localstorage.ACSHASHb884ef4864d6867bd00aa4a7a5cfb36.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b884ef4864d6867bd00aa4a7a5cfb368","sha1":"d45d8bd33632588a913575910b3d0eabd5ad3828","sha256":"177f6b14ceb87d301946d00124195ebb755a452ba40abca5cf6a4e77e52222f5","sha512":"375a8412459bbe64b6024c462d996b4b48de246997ba36f5e26379f163d5faca69cecc79e4fd246f92079a23dcd36ac2e8058d2c9663ba9d31c07c6786269581","ssdeep":"","tlshash":"055149467ee213310d97119deb4e7090e03c661ba25d8a59bc6f13d82f4872d63e43e5","size":3116,"data":"","first_seen":"2024-01-17T11:29:48Z","last_seen":"2026-08-11T17:29:35.429277Z","times_seen":986,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v4.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fd91ee5ca6194ecda563b58efc45a31","sha1":"526fe129cbcf4816dda728c21d62c521921a0dea","sha256":"7f524501e24731095c4a4e0099fac5b14806eddac9db74f075166645c1be6ed7","sha512":"56d8e72e6f1af6e713c92705ca3c4fe045650c4012eddd840a95b6075dcd13eba8bbba4bf646f4d93954493065e9a93105b1be54e1907ac6f67c798f031c3688","ssdeep":"1536:IMYT4Pkz0hiK7EgmrawceNnYVVsKzmQVZywlJOPtpDiYKtJhcvfDv:IMYNg2phYVVsKz7VKVKuf7","tlshash":"de63e7e97681703543a364b6203f610bb33b6a69690f8154f114e4e63dbde9e8237f6c","size":71825,"data":"","first_seen":"2025-09-11T17:20:06.578287Z","last_seen":"2026-04-15T17:41:59.47221Z","times_seen":400,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9b0e9bf4ae897051dc49ec0fb0dec098","sha1":"f7b5740bb90e312b1f8289c17720159872389420","sha256":"0d67997eeb1fc847a1da396fca21672c9eba495836b384051e01106b47199d40","sha512":"8d18795a5057e4999fb6a7d73458a305e30b52920e25d349c4667e7977500c605d781e20955faf003f3ced90d818677cceb9312fff1225966bbcb1daccf3e0d1","ssdeep":"","tlshash":"3a0122446c2984f83a9e239fa376e2de7160069b1805f701788cad089fa0fc88a5dde4","size":662,"data":"","first_seen":"2023-10-18T13:42:23Z","last_seen":"2026-04-15T17:41:59.548021Z","times_seen":362,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"10f7433b06ba90f5bca9d7de3424cb13","sha1":"59c7086cf38ba17a48d64122370fe53647f2c34f","sha256":"497461af4ec8729048d538a446872cedffc071496a3f56104e9d3c5859fe37e0","sha512":"cf25960bd33a21ba944c419143d4df7b863320fb94293345afaf40c2e71411847cf85414e6bcf0f8edb86c22b4233910c34628217267c83d96df1820c061432d","ssdeep":"","tlshash":"60f026acd6e52a17220a4114ae2da143a531c023459ead257fdda28c2f1d8a7c2993e4","size":545,"data":"","first_seen":"2025-06-17T17:33:16.440234Z","last_seen":"2026-06-06T11:31:41.086889Z","times_seen":709,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/wcp-consent.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d3cb898c8a0993331ee714b575fdf9d8","sha1":"54447d09be292066d833fda36f89db17cc3b3458","sha256":"9cd4693c8eeec654b06636d721ae14f4c4dd338a2e35c70fb2c04b76315085a8","sha512":"63f67230320f594c3cfae6a217bbbb368931dd55dbbd0d3921c6c44a04f7866fbe851f0df4f0b1668281da692f836563d4195ec7b624fdba43259fb892b4caf4","ssdeep":"6144:dIYsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIYsZtI0BGoHdo7NjIZjIZP0vC75F/x","tlshash":"11546d7fe3c420ad03012346b885bb39ba1d067d7691d6c5f84ca57d23c2b95c52abfa","size":279202,"data":"","first_seen":"2025-09-23T19:38:24.289636Z","last_seen":"2026-04-15T17:41:59.460568Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"92a7d729cdc064d2245c37ddae621fc0","sha1":"327f3853bf2bfa8d262aed30f5e2277e335ab5e4","sha256":"b50f6f394831aed19a9c505de527ffe47c03f0e1a65c6e1ed061e1bd570d7785","sha512":"c3406dd86aa606271ed66187c304f212714c1795385c0d966460a24ffd5f3314432473c137b25b4378b981cc9056285959b4559bc6c61b075c3d3d011a8ac5a1","ssdeep":"","tlshash":"559002816a7f919740101822ad26b95828d7496f5101699a31059104627959fc818074","size":55,"data":"","first_seen":"2025-09-23T19:38:24.280113Z","last_seen":"2026-04-15T17:41:59.549366Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-jquery-cookie.ACSHASH5c75a4fa9fb3503322f8a0c9dd5151.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"20aafdf6904d3dc5db0e0e33abbfc1a4","sha1":"cc1a639ff69fe0d8a8f1efee7fcb04941e7b57c8","sha256":"ee4e620f350907ce3867454b2bd45984be949eb46b113183d4b8b403032da14d","sha512":"91b0bd81fcd2d3d040d9fc1db74f5ca916ef88e7887d2868530bf1319eaf5462cc54421ab80fc97b258b569b9af40f2b9fd1b6d417c9a4561bba22edf785d905","ssdeep":"","tlshash":"7d2196d8708bb8474e665b26723f042e70bcde0194cc8848c702d9e07e30e032a71bf9","size":1418,"data":"","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.47981Z","times_seen":842,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASH6734c5d7a732130b83c7d4a6ba54dcec.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d7106db242c2b41f88a1b02418bec7e2","sha1":"7a445118f0b5712744aa4aed6889b28c1e7779f7","sha256":"044527a735b287bd84d2ae6d2d3b89c85b52c9750bb07e5aef19fb8f28f0442b","sha512":"c493fbd6926006108e56e23bb204bfe59a7364ed6d2409b5b258d9ea6c060259e13a7e7a22021607f6edd55eea52c75dfe7fcf18bb76d6e539fbd763bf399185","ssdeep":"","tlshash":"7de07d3c3851f0313f964ad7c279facf75e48523740c904411c48d9228cc50d16b0265","size":309,"data":"","first_seen":"2024-07-16T20:14:39Z","last_seen":"2026-04-15T17:41:59.45539Z","times_seen":518,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"94d1bf457ef148d9ed1735354dad7f88","sha1":"4d571686dab0a7c9fc0cab1c5883ea2d4455037c","sha256":"822da189e0489cccd7080a74aa1f9ccc9355bd5bf95b90167fe6c61908b62615","sha512":"435d88788cd11c4211c256ead8283f397a7b73d7e3eec206f96089d38347b109466b1919d1160b44331d599ae7e3c9a1e2970afbd1e99d1a20b602172d7017d0","ssdeep":"","tlshash":"efa00281663b42db41202831ad26b54829df4eab5245699a62059506627999ec814474","size":61,"data":"","first_seen":"2025-09-23T19:38:24.283121Z","last_seen":"2026-04-15T17:41:59.55019Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/site.ACSHASHd1da57737f7587d5304532e6afd0b53c.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d1da57737f7587d5304532e6afd0b53c","sha1":"c1d553b50560889c211d001adcbdfc7c8ceadc2f","sha256":"2a3cf587639bebf9cd9b3f948bcdea77de53a2ac783ffae2dff648be0edb00ae","sha512":"0473f4a57252b67b77d1e7af638a3253f1d4e815d7b998bd978e79d8dbc21a300d72463734044f43b1e227483317b7c749e7ca8e7715991a7f735e4693a6a58f","ssdeep":"192:OvXH2X1H7ySlEus2WpWG3cN4pHR9XXjRCVhGBgRswHNRT:OvmXZ7Sus2WpWa7px9XzNgsKD","tlshash":"99d1512e21e09ef3146b646fa34bd1c8b260905f3105da08bc4ef7690f6ce7456f6ac9","size":6401,"data":"","first_seen":"2025-07-24T21:09:09.189417Z","last_seen":"2026-08-11T17:29:35.517916Z","times_seen":540,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f7ac7c1bd2c97e5574ccfd8e1584a2d7","sha1":"9ee6a222a87e72ae42369f27555ecaa10d6a398a","sha256":"8db0724da52f1ea96304a72419f3563d1b34937fea7cb439ffd157a6fb8fb257","sha512":"5b687d781085fe121633deaf99f1c2e1fb352f4cb15ab218a7d174d75073d86f7468f65c34d16b05cc01d4a3423111c922b333d7ef531c7dd2a55d3a094231d1","ssdeep":"","tlshash":"eda002c405e9936a81a192888a5b598019dcd0301071c0e3a36859569193316e3601ed","size":62,"data":"","first_seen":"2025-09-23T19:38:24.285095Z","last_seen":"2026-04-15T17:41:59.553955Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"5b81fa6fcebf12c0cbe7027907ac29e8","sha1":"4f6cf37abf97c59c8b2a7d0ec98ec59fbab34675","sha256":"72ee2e877450dff4ac46cd196aa5d7d9ed6ed736c7e0dc4daaaa4d0d7d4d6ec2","sha512":"4a77b18f1700bc3164d3d7444aca45f9c86c51ac50c3a7b829f347ec12d6ad926492667bee72830b9d6b14f7626111bba959bb802e2f24aeefd00553a57281ed","ssdeep":"","tlshash":"438004c4144105d4c7341430d55d15501150c07c40551431d4410105500010f41045f1","size":37,"data":"","first_seen":"2023-08-13T05:26:01Z","last_seen":"2026-06-06T11:31:41.096996Z","times_seen":3541,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/2b-8e0ae6","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a65b505079882980bfe9eb49a15e7a7c","sha1":"95421822db52c1f6fda5bd7e1cac65c253ae0c05","sha256":"62d309c44fb75db449fca08eec45544430c51b935f2b96de48ee85bee45f5c54","sha512":"ef5c21eb60ec0e45c1a3bc8bb3939a78c08e5efba018dfb58f05c5b361f3cd2648c9156ff9ce1bffbbdbdaeacd1265c4529265bd69b7b8b03d561ef67448068b","ssdeep":"3072:pf4HuF6pxnISCI9d1EwgXA7CiIEMK/xw/:pf4HuOIuNw/","tlshash":"ecd33c99b15835768bdf50fc978f1408b2334429944a6458b82cdded1878e4f21b7ff9","size":141432,"data":"","first_seen":"2025-05-07T21:31:43.723137Z","last_seen":"2026-07-28T11:35:36.700754Z","times_seen":947,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH92086374c4d8b656871df44219c5b.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"08c5f9cb4220e78ff920dae3a7a8ed53","sha1":"06063cc0de00b0f698b07deb66ddede5c60940e7","sha256":"e8b12100e50470ae78ca039d5662394a89e01c61fe8d4682dfe606e906e677ed","sha512":"0e7ed8c068fa14123041314f58c1473df3eb60c3b6ce1a95b1a7066c1b151d5d7ec6f2d585b2862721db164b9ce79e61dfb6fb0a53951504bb2235739b4c35f6","ssdeep":"192:0OQGrOUjDYq5FEF/zj2wrEEegbSYCkK2MlXW2UqEcK9MwC1uAyI9J3Yullgubepd:DrzjDYq5FEFLjRJpKJxWrqhKGXy83Y39","tlshash":"2f12311d27f65132493f747d1f2b664e7352431bf0488a083c8f42a50fa1ea6d9f2a99","size":9849,"data":"","first_seen":"2024-03-18T17:19:55Z","last_seen":"2026-04-15T17:41:59.513445Z","times_seen":244,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/base.ACSHASHbbf19119afee3c72253b59e12c3b5503.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"bbf19119afee3c72253b59e12c3b5503","sha1":"e6cfe58feb83cc077f5d59fa96b3378ec7e0819a","sha256":"ce176b847d387500efe712b8cc451dfa985489cd38195d1dae6772e8661fe228","sha512":"4d11ac2de4ffc4d1d16bd77cd0991bd8809585327ee34a0ea31d9f6ebc75cca9bcae050a961a256081b3c63c1a3165f938a58a93fef2a6197f5e7444263e8997","ssdeep":"384:tSsg7eeMXX3/4WKtr0Ai6QIG0LHCiX+JLBJ:csMedHgWKtqEGYiC+JLBJ","tlshash":"b342964927f2717641bb103a6bdf2a81f935524f32c4c9c8bd4c6f781f19e1182a6af6","size":13185,"data":"","first_seen":"2025-05-28T04:59:18.032556Z","last_seen":"2026-08-11T05:10:21.81872Z","times_seen":661,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/launch-41185cd0b005.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e93e0519c88151676535f31e8a4e6691","sha1":"3bd4f0140d05a3ee08a9e4f55f8fd9420cdd201e","sha256":"52a0d1c53dc58e12a59c76609b5946b7790f28b8f88dedc59eb72cda448ad354","sha512":"2ef198231f3645123d423629e6f972b6bd90d5fb38aec66a62268db901eeb6ba72b24cfa5421f019aa2a3f2b6c3363b08ce6adb19e8f58e5d848277e99a89f3a","ssdeep":"6144:3ScZL0c9YNyCLvmANHSaxbVjqxxk9cuNZchdwwOT1fEAHwPos6/pFvpqu:Y/vmAlSaxbaQZchET1fpHyos6/rvp3","tlshash":"b81506cbf600147552ee21aebbebe185763437889014c410b89fcd5b7b75e44f0aabe9","size":891578,"data":"","first_seen":"2025-07-03T00:12:13.398166Z","last_seen":"2026-04-15T17:41:59.477419Z","times_seen":138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-light.ACSHASH5987fea4fceb192e7046aa914c7350e4.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8af0ec8d1bf286f330a640028e291644","sha1":"2d4869c0f5e49ba97b91d63793276b70c51452fd","sha256":"bb6ea61f58abc3c1445fc565e785ab12e2c344fe5e873446c6c5ecb09f556078","sha512":"5388b9f84ef1aa3086334a01aa681b9607c9bf44902b1a9041aa2a715546c396cdd3c6dcd90fa167df9ff3d3e8de78f13178cae2f99130255e2d43cd4315a4e0","ssdeep":"6144:o0Liw9tq3fe4Z2F8E79Cg+QSCOn+a9+Xx5xJakA1FXPTf9u:o0LgPIxCcakAzhu","tlshash":"dfb439d87262b57245ebe2baa16f1943b236688ca504847c7459ccdd3cf8c8d017bfb9","size":537901,"data":"","first_seen":"2025-09-15T17:19:13.461204Z","last_seen":"2026-04-15T17:41:59.469725Z","times_seen":19,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASHbf7b336dbb370c984e1bf59b1a980d86.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4cffc2c9b55f8bde649e0d2535a1eebd","sha1":"2aaf4df1e02ed4f5bb48f00a7423f748bf544e0c","sha256":"7bb50a050792f761855cc330e0248d037b37dd68fd23fbb7db8a7e8694f50a94","sha512":"599c87219b7e264cff8e6951192c691e26dffa88efc607edfe9205f1bb08da28fd61b508fae93652be36be1ada57e50661490925b247a43c3eb7f24d8ca0c8d0","ssdeep":"","tlshash":"4c312159fa89f01107638666ab9f150bf134d61163c4f3709380d1927e9069f99936c7","size":1716,"data":"","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.480979Z","times_seen":780,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-sku-telemetry.ACSHASH05922ae5c69da5ad2aeae9f3b3a651.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"05922ae5c69da5ad2aeae9f3b3a651a1","sha1":"a977a5af19e280a09c4a069ce3578ca4c04467e1","sha256":"d7d858a30f0d153f23ae93b891aeb9a531b4dad5bad436fd493907ae6b1ada67","sha512":"d377e458f9519cb459f27a5e67ccf1cb6f6648d03d9472b0c9cfe7afcfbbaa6215b387833227db9147f426f44715de345ac2968e0ddaf51c3583de6fb566d8d6","ssdeep":"192:gOXv8KLobVkiKcSkP9pJkiKsNrqrSLxbPDH41FQXiucRWWK5lwepXb1qL:hvxceWFk4gwcWPRLQ","tlshash":"3a12659977f221f19a6b207de69b04c8f17851273909ca01fc0cd2185fa8be5d6f9bc9","size":9375,"data":"","first_seen":"2025-07-07T04:53:31.249906Z","last_seen":"2026-08-11T05:10:21.796475Z","times_seen":623,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/publisher.ACSHASHd04116a7de4f2a26cdce768dfe83c5b0.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d04116a7de4f2a26cdce768dfe83c5b0","sha1":"83a51ad446f944c97493022a32cdc51a95b3fd34","sha256":"2b3c1170ccac9b1e2b0c70a6d2a6d8c290cc55f3d7eea099b13d172289553b67","sha512":"ea8440395285519dc7fd4dd6f8f71357c01f01120606085642eb9c8e4d21b2223ea754fcd324e395b8acaeff27105c313ba4a204c152e0c18fd48bf5f74a9bea","ssdeep":"","tlshash":"130178c3d8f4a89362377ca5ea048790e146b35703c8ac447ede85bc5f573930b116a2","size":657,"data":"","first_seen":"2025-02-07T17:08:29.255155Z","last_seen":"2026-08-11T17:29:35.510685Z","times_seen":1028,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASHa238861e6209e4e02576ddf5d1749c8b.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"be3f2a9f6a41fc40556efe260fc861a5","sha1":"ef6d673802edf44c01eea9dd86df4e5acd21757e","sha256":"c94f3b6aa377cfc8d9416f38aedf1e49c43de0bdc6726858720610827df2dd3e","sha512":"05ed779f490e9f21153e0c6838198a9e5337c4361644e62a5c99bca3978001840cac2e947874983fabf15573fdda548567176f77b0393a827e27e47ecb01792a","ssdeep":"","tlshash":"d471765a7bc5e030ab5d1433e26fda0a717136a3c84980a1f0598ca83a75b6572b2bf4","size":3642,"data":"","first_seen":"2024-08-06T07:44:39Z","last_seen":"2026-04-15T17:41:59.453517Z","times_seen":467,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-polyfills.ACSHASH79ca9118c9426ba6ea5a615503dde6e9.m.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f381d5147c85ee687ea8fbef32c83d37","sha1":"eb654abaf1df5ccb830763d5a40140b5c093c49f","sha256":"2d0832b29f1b3347c4b5046c373a635884b76abaf2de3ff650ee74d8b46f001e","sha512":"cd6b4deb925037a6c0cf4baa5ab600891139d99bfb9173d3f3dd4660d281a6266b5709d53770395e7459d9d2060e37f06295e8f9719a21f3ea8433d9e2206e65","ssdeep":"768:qCLbrNurYZRrfHvWCOqbEC9EbivVZh3ctWNwtBSg646z:qC/purwhfPWCOqbEC9EG3sDP6z","tlshash":"d7532b9cba26b07297e762b6403f020bb637557ab404c0d0b158e8f52db8e5e457bf39","size":61208,"data":"","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.514413Z","times_seen":455,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH2b143bed0ff34bc70bc0703346f70.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b143bed0ff34bc70bc0703346f70e08","sha1":"7fb14a8842293fd041c7c138285ac2f822ac4b4c","sha256":"c35bbdee4a46bfbf552989e1126e1f09b454eb3dc2523376c38964bf6128be86","sha512":"46bbf881243ec3c27046fcb66f9d8412b459cc7b6da1abf0dcb5f70d578f57e9a88d52431753b65f851892055ac17edd9446e11ba67d7b0da80b2b2615f67688","ssdeep":"192:7GrOUjDYq5FEF/zj2wrEEegbSYCkK2MlXW2UqEcK9MwC1uAyI9J3Yullgubephg2:qrzjDYq5FEFLjRJpKJxWrqhKGXy83Y3N","tlshash":"0c122f1927f65122493f742d1f6b618eb351831bf0488a083ccf43a44fa1ea6d9f2a99","size":9316,"data":"","first_seen":"2024-08-07T10:02:53Z","last_seen":"2026-08-11T17:29:35.536143Z","times_seen":829,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-click-group-telemetry.ACSHASHf25fec6821f63d701a6b62.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"f25fec6821f63d701a6b6291a4011894","sha1":"1260ac884282372b86f3a600ba8903ad75983e67","sha256":"dd8619be444cce5f8db053215bb018c0bbc09af7baa9e66618bdf041b0a2e09c","sha512":"1f3c21e2c32dc8362a1ca12801fec56bd22cdaf0bb7fb8d0d118348019eb843a63a171154bb0392dfee268c5727f47cf139144596c0dfb7d12125ce659db35c9","ssdeep":"","tlshash":"7e41af1636f261e1021750ee03cb9185b226e58bb649d58cb99c97180fa9e71b5f3bcc","size":2432,"data":"","first_seen":"2024-08-06T07:44:39Z","last_seen":"2026-08-11T17:29:35.506339Z","times_seen":1164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-light.ACSHASHfe9d5283cc0a38f995b64bf0f39192eb.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8197ef94674599aa52224128f2503e68","sha1":"a6f2244ccc50a9ad24949b753618685de96da273","sha256":"cff84bcfa285e077533055802840aad0ea2c6e07993e7d7b90dc19a596d26f6b","sha512":"9d08aa1e4f2f6a48e776168e97e8f341c2184a5fdde1b4f501b908c7ea48a2a0286e9106ae4b5a44816d8ca618610008838871566334f4bdbbddf56ca0a78cc6","ssdeep":"12288:wDxREkZQKdaFA/RIc3f+u2wc/WVKSjdJjfMNlR48tmbK+2pA9XDTotHd9:EREkZQKdaFA/RIc3f+Pwc/6KSj7fMNl/","tlshash":"5e94c70837f2227640a7716e5fcf9101b230404f660add987dacdaa41f95a7846faff9","size":419609,"data":"","first_seen":"2024-10-04T19:42:34Z","last_seen":"2026-04-15T17:41:59.529605Z","times_seen":210,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-product-pricing.ACSHASH1db38d888c5d592f8fcc31c2e4ae.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"de9b8e2b4eed09785efe9462d2630060","sha1":"2ea766767150c170f7519e719513aa1ad0ad4723","sha256":"d737776236ed1a8bdfcdff43b13adc8190c3c88847b3b69bc26c6f73b4bebdc6","sha512":"f17b6590a2f217c7a184d0030f4c56600da96616a36dc584b2b653222f40f090b6fb2dd66307df06677beff1ebc69b3c0b981f0e8366528c1f1dddba51102579","ssdeep":"1536:ZJBBrkzb7l2nUcNGCHjqjYvYWIZFEs6+Qfamj0pYAL3oDpZA15pepKMVOiKiU3GL:a0jqjYvgU9f1","tlshash":"abc371e641f41f23046e1269dbeabfcf79ae1017a76a90d23c8d12d80f76a2443b55dc","size":121257,"data":"","first_seen":"2025-06-03T08:29:31.327546Z","last_seen":"2026-04-15T17:41:59.485084Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-contact-sales.ACSHASH7a524381cfd41a23a665d6a325c6f1.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4c899bc9d9bdc8ca4b7ad57788766bc6","sha1":"40d245c6b5539095a3750f934a918245392b0b5b","sha256":"086661942e79a55f9ef888bc5b8ab393532691c20eef554d2b3d9e93b8420aed","sha512":"d35fb28253e919e74f59bca3d1d0a4cf33976cedbe0d34e2ba72235cf7c243077d540df7b41b6d4b76d1bdd11aad4ce985affb3f7b2d12af3393146a713c6ed6","ssdeep":"","tlshash":"95016f6c5134c5b756fb099ab20ea38071f1a06af407b8e4184d8c1d2aecf9f0e32981","size":814,"data":"","first_seen":"2025-01-11T07:57:08.989952Z","last_seen":"2026-04-15T17:41:59.545943Z","times_seen":139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/rum-standalone.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5e8251b321087f7638883fb4d5793722","sha1":"1e54932bfa11be05349c57b74370cc4d2fb43983","sha256":"7405ac8135bc57a96fb585cb03c7c950476620ca0db911d7f4e3848f6f499c20","sha512":"c1fda021959b10d95e49d40913ea356ba58b244efe2ac589a3080798da9fddd003c22cf6cecd8cbf318df95f38add88cbfc7f786775b47089d1a26451b83d33e","ssdeep":"96:9J4o/vHtcZlHR9FGSA8a32BtT3lh21LZU6KJyaz8qJWDuB:T1vHslHRmSA8y2B93lh21LZV+yazFJz","tlshash":"68c194590da2413141b3516f1b5bfb677263a11772c6e1863dacc3003f1aa5bfab1bd8","size":6134,"data":"","first_seen":"2025-05-23T15:02:37.102812Z","last_seen":"2026-08-11T10:28:42.227822Z","times_seen":3331,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-httpclient.ACSHASH726084fbb35cdb34b4b6a7f50889354b..js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"626f44e8649ae3ad321f85283fbcf42c","sha1":"1e1838fa037f19903512342f06856d80b0e659ed","sha256":"4c12d6686db8795401dc2f0114f91c4ac471e24a616229ddbab251bbe5a5649d","sha512":"6cc727ad42a1ad0269a600616c5fe7b9f7744da80a5845f01b489eb5ead0bd530dfed00733cb89164863514ece598acc1f6b12d5e06aea2c0844d69e82bc3243","ssdeep":"768:R/IeD34NYBHEurgK/R1vfz+DGe0BWU1OxLhRMkcT5xQIdK9sTeQFH1:R/D47u/RFqcWcQWsW","tlshash":"7f03e7cdb692f0624367b1b0d07f160bf63a5958a48c98a0e114e8e63cb941fc677f6d","size":40793,"data":"","first_seen":"2025-07-31T16:39:29.840984Z","last_seen":"2026-04-15T17:41:59.510549Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-onecloud-util.ACSHASHe27d1f017cb64db7f5a2a53fe34faf.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e27d1f017cb64db7f5a2a53fe34faf64","sha1":"795eab7cd51acee60158f8938c5ee63b47e2efa2","sha256":"edce1c270b17547cb4353cb02df79ab58147a7566fe4ccf6e5df4423adde80bf","sha512":"c9984eb59da79661602aee8868526869dbe8f8b3e1ce83ab2cda43226f3d13f0d540fcd24722cabf32ce90aef15e40cb5d28bf2f2a194fe4a0d4deca800e9b96","ssdeep":"96:2VZw3gPuCrA3bm7+qWtNmOy47ZhiqdZCOkhZvRT0xZtCE13FMksINza0IMqiEd:2VZ4gPuCQbQ+qWtMOL1hiDOkhZotCE1K","tlshash":"e5b1b4863af12062177b604e838ba0c0b735e16f3a59189579ce5a141f9cf3c96f67c4","size":5219,"data":"","first_seen":"2025-07-24T21:09:08.971375Z","last_seen":"2026-08-11T17:29:35.426883Z","times_seen":899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/faqs.ACSHASH3e2bbf17b5bf77ae832449b6e06073ab.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fe68b59e840a1a274393b3ab03c85e96","sha1":"c8c1b1196b05e9adb6d342390956a231920b2017","sha256":"9f01aea27d73c422ac5e7e87c2f7f3ce364e1f940faeb6cf3178b5e13cb43497","sha512":"58921a6195363008a3dd65af8d115828c3f93fb23cccc9fb5d2faf7af55f5779efba947b990dedf5b2751f3ed0ba4071f006873ffb68f77cca3c8d565092a90d","ssdeep":"","tlshash":"590190faa7d52c3510b9d798434d7f85e22ab0199001cc78956bcb5e2fa0f59b5f1870","size":775,"data":"","first_seen":"2024-10-06T09:12:11.176897Z","last_seen":"2026-04-15T17:41:59.515871Z","times_seen":142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/cookie-compliance-manager.ACSHASH015456ea381eb18f1c6cd758c1c3.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5f316ac91e4d6efa34dd46eb3a7a4013","sha1":"14a2eb2cc23686ca1f4c0552fe0cf327214cddc3","sha256":"803c444f1e165ab1d3de7fca662f93fe62ee515b28d1e66643dbe36a5ec44630","sha512":"fe29962b5ef4f634adacae58e340e78aecbdae1fc27f118804e114602e5436b7ef9bf5e2ec06a1ffcefc2212232ae3ebf9df67d8404f911679a62fdfeab99523","ssdeep":"","tlshash":"7041a59763c9a4400b8b013a231f9987b6723fba9d084cd3612085642e62b3673f77e9","size":2343,"data":"","first_seen":"2025-04-10T16:45:39.142537Z","last_seen":"2026-04-15T17:41:59.462132Z","times_seen":160,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/msocbody.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7d3aba5d71793cce4bcfebce80e0e8a5","sha1":"0667c5197a01a25133d3f8e18f1f2a0efa95eee4","sha256":"eb6c992f1831f098f4c30fc7a89fcdaad16098d5ceb1d043e82b1324a9f74677","sha512":"f7f7bbd39309d4fc0a4d5a496ac1581920583e9095899f03b6952a19ead1db92ede04d6a8bf6787e05bc99a71f3d9fbb2cf3056d0b99c18eabbad4f11297b021","ssdeep":"1536:J0tWbQ0IWRSv9mTCU5080mcnuvKdwdL4/aC9Mj1FWerIj9uVbxdu6Dx36HMEHmi5:WWbQ0I9z60rmkm/XCJ8Y","tlshash":"92d33c70b210247686ef02ab529ab3c57b6420877500e499756ddc0e1fddfca21a7eef","size":139556,"data":"","first_seen":"2025-09-12T00:00:49.073082Z","last_seen":"2026-04-15T17:41:59.494199Z","times_seen":48,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-events.ACSHASH4c28b55b872280fe389b01920b5c9315.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"32ae7925b14231b848f5318c86e3f90d","sha1":"aa4142b301f38d8a1bfadecefd9953ece384f562","sha256":"b17fc6c97200b46958998570610cd3536f0617f7ea9593dd3e6d6f4eee9daf82","sha512":"640079d7f0b679f1ba94762ba000e3c7f12f8a950c43959a19c37a8b11903e4ef83bdff677286f233043b285043bd2f1a1e58e69d88ee7ac63777efff32f8e36","ssdeep":"","tlshash":"7561ae5926540ff898da047df36f77aa757224f2a16100c0cb2c9c784e68e48916dd2b","size":3289,"data":"","first_seen":"2025-05-28T04:59:18.074898Z","last_seen":"2026-04-15T17:41:59.530504Z","times_seen":44,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/msochead.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a887ff5f5da3d49e01f4a6ee1b3f8a06","sha1":"7f2da8bb0b1b1869ba4eebadb6233e66e17f2870","sha256":"3fd50107e2211b067c9c0d73e822a5639087504e4b7491e176a0ba7eda9ee22d","sha512":"c5691ed783d3a2ada73d78eabae766a6401eafb3d35ccef4681096819d6ecfe8699087170162b389cd6904f800ff6a5e1ff3d5d1fedea4965011502059846f1e","ssdeep":"1536:ECkYe2qD3D1Ug5xeKx7j92Vf6zqh5kCThY6g3Eh6ZphYFN7Qfb0a3rBSd/v:fY5wKzwqMindYFM3rBKn","tlshash":"aca35c79b19810734bb315cbf1a23244b92d13e77400e4e6b55ec9583bdbacb5063aaf","size":99328,"data":"","first_seen":"2025-09-12T00:00:49.088544Z","last_seen":"2026-04-15T17:41:59.507661Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-action.ACSHASH02f6c2571e097b3a29e66c43eeddac08.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"0536048a262465cb22b560c666018a77","sha1":"332897a6f8e050baac8fef385bf05b3cbab14763","sha256":"5b748160125fbe8ff151a19411de668c0c2cc4509bbacf5de158f3e4f7908807","sha512":"acb7320771c8b6cb70b3b9d62496a271956933d6c81601d44cd85a90378391dd1ad5bbca656e295aec9de2317427bb617d7a8877a4b7351efa4f9987fd1d1b7e","ssdeep":"192:3lGqnBqPmIa4HAb1WWe13GgkNb2c6cN0JL2xf98k3lPcJtQIgGySjye1nGEZ8Uhh:3l/gPmIaP3U2gkNCcUJL2xfN0Jt6G351","tlshash":"2412942d05f34271833728bda30fa390e1ba21573268d8997d2c96546fdcf2996f36c9","size":9341,"data":"","first_seen":"2025-04-01T07:25:59.502365Z","last_seen":"2026-04-15T17:41:59.473264Z","times_seen":65,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"11c729ab0ee4ae9d2f0d6bdc5a782c2e","sha1":"cb75468cbfd58f4c356540894fdcd70f33947a47","sha256":"55bd3271aee76711988b253974ec90779be27a9186a8bf5cda581e7a1d8e5889","sha512":"b58aecf6b5c7873588648eef14db8c04aa4f40a274c6ad15f2fdfd39a4e2cb2c3c283545b07d65eaffcaa5e8f691bd33dadc2592046c555a54089692cf39d956","ssdeep":"","tlshash":"75e02238267205d6865fa30f8f6a9a89715035932c3aba09bc0c0c492f08c8a211c140","size":301,"data":"","first_seen":"2025-04-24T03:52:47.408895Z","last_seen":"2026-06-06T10:29:29.913799Z","times_seen":507,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-cookieconsent.ACSHASHc892f451b0c4db9c8ab2601a427c9b.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"96f0c5b1219e39b8788028f5c17a5ad9","sha1":"d6dce0de065b0d13905eaeda0ba5c0dea3d8f67c","sha256":"1fc2bce2d46df4565b8c488b22225cfe7adb7c37cc9a542d4f85b61995b306cb","sha512":"057810fa0558506c6b8abecb1a7a58ff61da0609b3a5798bb42de3a9b801ca0d8b20c4c1f9a250ee33d30492452cc5c4553332b16300408aa0c45b1515d4af10","ssdeep":"","tlshash":"93c012272681430853e70271510a4605f20062f9d79c013a1a5015a005a0e1936fc9da","size":175,"data":"","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.511683Z","times_seen":842,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/featurecontrol.ACSHASHf120033122e43a4cb0b53bb306afc5dc.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c22ea5b46f3fcad90da0abcc0a3f73d4","sha1":"2db789c63afb63d98932d7b55907dc3508e318b4","sha256":"8334daa260516bb896407461e5f10e8e3041b06c56846bbb9d3435c6e77513ad","sha512":"a0359f8c25dc40ceffd14a41ba81794717b99dabe78cbf8a8678f3e3ec57f317388ca0dc55b1cc6ad2d6c13d2b3caeb5a64527bb2c646ed2d93775437da646f1","ssdeep":"","tlshash":"25c0803f756875343dcb0df5501d4ad56c1e5dd401055131195cd85464d8add4136a15","size":159,"data":"","first_seen":"2023-05-03T04:39:02Z","last_seen":"2026-04-15T17:41:59.540908Z","times_seen":842,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"02284d956e90a6eb7d2acfafaf790b90","sha1":"9c879d8a9c377ab693b909548b18c3846bb6a587","sha256":"05d14ca7aab09347063692ac7b68c939e9a4592fd2806ec76bdc3dc5609c0e56","sha512":"1603ce6071cf76deb09121dfbf864342981e45e5f63627b68758edf76a66244a390ffea9a862eb73b56a0015862bbd213cdb1fa05a48cfc755c3c96d09d0f70b","ssdeep":"","tlshash":"dd0176683cfaa08c0025605d5fabc20074712d17354bccadb3ecaa351f42623ee575ab","size":739,"data":"","first_seen":"2025-01-24T13:20:05.749504Z","last_seen":"2026-06-07T06:24:15.916384Z","times_seen":5884,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASH6734c5d7a732130b83c7d4a6ba54dcec.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/v1.ACSHASH6734c5d7a732130b83c7d4a6ba54dcec.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-135\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":309,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (309), with no line terminators","md5":"d7106db242c2b41f88a1b02418bec7e2","sha1":"7a445118f0b5712744aa4aed6889b28c1e7779f7","sha256":"044527a735b287bd84d2ae6d2d3b89c85b52c9750bb07e5aef19fb8f28f0442b","sha512":"c493fbd6926006108e56e23bb204bfe59a7364ed6d2409b5b258d9ea6c060259e13a7e7a22021607f6edd55eea52c75dfe7fcf18bb76d6e539fbd763bf399185","ssdeep":"","tlshash":"7de07d3c3851f0313f964ad7c279facf75e48523740c904411c48d9228cc50d16b0265","first_seen":"2024-07-16T20:14:39Z","last_seen":"2026-04-15T17:41:59.45539Z","times_seen":518,"resource_available":true,"data":null}},"time_used":1057,"timings":{"blocked":903,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH81b1ef0c4a6b80454291234f_002.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-reimagine-base.ACSHASH81b1ef0c4a6b80454291234f_002.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-7b5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1973,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (510)","md5":"81b1ef0c4a6b80454291234fcd6e45b0","sha1":"1353f3119d378ffb222149ae19755423ef5347be","sha256":"b05d865a37d5efc60e028bc9fbc6b63459c78d21b0b70b3797ac97c1ad9ba88d","sha512":"6409931af06bae75e4cfc57ff2b877915404a9d805f8c9076390c4bc8ff634ba96b2ed561fcc4e57869110e62be05ab75a1578e7935cec9605eaa77c893643ad","ssdeep":"","tlshash":"a041424f86f38fa3302a01debf905918a9417583e2c549df58949c6e5a8f42d0b37d6b","first_seen":"2024-04-09T09:34:43Z","last_seen":"2026-08-11T17:29:35.434999Z","times_seen":807,"resource_available":false,"data":null}},"time_used":1451,"timings":{"blocked":1300,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:49:32 GMT\r\nConnection: keep-alive\r\nETag: \"68c3984c-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":601,"timings":{"blocked":262,"dns":0,"connect":0,"send":0,"wait":161,"receive":178,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2","fqdn":"c.s-microsoft.com","domain":"s-microsoft.com","tld":"com"},"ip":{"addr":"96.6.17.223","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoft.com","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft Azure RSA TLS Issuing CA 04","organization":"Microsoft Corporation"},"validity":{"start":"Mon, 21 Jul 2025 18:25:48 GMT","end":"Thu, 16 Jul 2026 18:25:48 GMT"},"fingerprint":{"sha1":"53:8C:3F:30:23:61:D8:6A:C5:D2:EB:98:33:02:6B:24:74:8A:06:8E","sha256":"93:A2:1C:36:17:A3:04:0F:E3:C9:48:67:9A:30:C2:2B:DC:BC:76:F6:4C:32:07:0E:10:E1:EF:D2:03:9F:CB:57"}}},"request":{"raw":"GET /static/fonts/segoe-ui/west-european/Semibold/latest.woff2 HTTP/1.1\r\nHost: c.s-microsoft.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://microsoft-teams.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 29388\r\ncontent-type: font/woff2\r\nlast-modified: Fri, 10 Jan 2020 19:09:43 GMT\r\naccept-ranges: bytes\r\netag: \"5b68d583e9c7d51:0\"\r\ncache-control: public, max-age=108128\r\nexpires: Fri, 28 Nov 2025 09:13:44 GMT\r\ndate: Thu, 27 Nov 2025 03:11:36 GMT\r\naccess-control-allow-methods: GET,POST\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29388,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29388, version 0.0","md5":"6e75a94d5f7170a1ab532d32c2a35755","sha1":"9c1b6fff544089941bbeddbcf529c3f0b46d853a","sha256":"d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f","sha512":"27cdbf98a3f42510eaeb28437e3c4661734b685d63eff5e47364ac46b73de617894edcb19ddd9afd955de192cfd8bb755998ed609ec2c279e9afab3db2583175","ssdeep":"768:2075f+Dti4JBZRdp49Z5wmWPb2O7a35bAvDWIfe:2k5fOtiCXvb2OG3I1e","tlshash":"f0d2e1ceb288a6b2cf6f2234d60344d63a3be647565d38b4adc49d918b20d0fe4dd04b","first_seen":"2023-04-18T11:30:37Z","last_seen":"2026-08-11T17:29:35.447354Z","times_seen":11966,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/favicon.ico?v2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /favicon.ico?v2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:37 GMT\r\nContent-Type: image/x-icon\r\nLast-Modified: Fri, 12 Sep 2025 15:53:08 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c441e4-3623\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13859,"size_decoded":0,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T21:57:33.47713Z","times_seen":17844365,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/Blog-1.webp","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.256Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/Blog-1.webp HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/webp\r\nContent-Length: 502\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nConnection: keep-alive\r\nETag: \"68c4409a-1f6\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":502,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 40x40, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"419f88e695a62cec374cbbe759f11754","sha1":"69509ddecb1b082020907299471177772db59070","sha256":"2c13442d9caa9698d2d10443eb6f0cfc395dd220e60763ae0c3a4a6044db7603","sha512":"381537e55704202899317e4780520f66ec65c0f6cdf59633e61b7e880fb056379dfd539a3ca2c890bed3087dae0f56550071c7738b6f372bd0514531f31f2b49","ssdeep":"","tlshash":"d5f0540dcb57ca10ab57e98189ee02ac1c7317e60f4f051538cf149b1320e08a231c8c","first_seen":"2023-05-06T00:32:15Z","last_seen":"2026-08-11T17:29:35.551282Z","times_seen":519,"resource_available":false,"data":null}},"time_used":2586,"timings":{"blocked":2432,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH2b143bed0ff34bc70bc0703346f70.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.260Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-reimagine-base.ACSHASH2b143bed0ff34bc70bc0703346f70.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-2464\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9316,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"2b143bed0ff34bc70bc0703346f70e08","sha1":"7fb14a8842293fd041c7c138285ac2f822ac4b4c","sha256":"c35bbdee4a46bfbf552989e1126e1f09b454eb3dc2523376c38964bf6128be86","sha512":"46bbf881243ec3c27046fcb66f9d8412b459cc7b6da1abf0dcb5f70d578f57e9a88d52431753b65f851892055ac17edd9446e11ba67d7b0da80b2b2615f67688","ssdeep":"192:7GrOUjDYq5FEF/zj2wrEEegbSYCkK2MlXW2UqEcK9MwC1uAyI9J3Yullgubephg2:qrzjDYq5FEFLjRJpKJxWrqhKGXy83Y3N","tlshash":"0c122f1927f65122493f742d1f6b618eb351831bf0488a083ccf43a44fa1ea6d9f2a99","first_seen":"2024-08-07T10:02:53Z","last_seen":"2026-08-11T17:29:35.536143Z","times_seen":829,"resource_available":true,"data":null}},"time_used":1476,"timings":{"blocked":1321,"dns":0,"connect":0,"send":0,"wait":154,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/cookie-compliance-manager.ACSHASH015456ea381eb18f1c6cd758c1c3.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/cookie-compliance-manager.ACSHASH015456ea381eb18f1c6cd758c1c3.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-927\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2343,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (792)","md5":"5f316ac91e4d6efa34dd46eb3a7a4013","sha1":"14a2eb2cc23686ca1f4c0552fe0cf327214cddc3","sha256":"803c444f1e165ab1d3de7fca662f93fe62ee515b28d1e66643dbe36a5ec44630","sha512":"fe29962b5ef4f634adacae58e340e78aecbdae1fc27f118804e114602e5436b7ef9bf5e2ec06a1ffcefc2212232ae3ebf9df67d8404f911679a62fdfeab99523","ssdeep":"","tlshash":"7041a59763c9a4400b8b013a231f9987b6723fba9d084cd3612085642e62b3673f77e9","first_seen":"2025-04-10T16:45:39.142537Z","last_seen":"2026-04-15T17:41:59.462132Z","times_seen":160,"resource_available":true,"data":null}},"time_used":1610,"timings":{"blocked":1460,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/msocbody.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/msocbody.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-22124\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139556,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3336)","md5":"7d3aba5d71793cce4bcfebce80e0e8a5","sha1":"0667c5197a01a25133d3f8e18f1f2a0efa95eee4","sha256":"eb6c992f1831f098f4c30fc7a89fcdaad16098d5ceb1d043e82b1324a9f74677","sha512":"f7f7bbd39309d4fc0a4d5a496ac1581920583e9095899f03b6952a19ead1db92ede04d6a8bf6787e05bc99a71f3d9fbb2cf3056d0b99c18eabbad4f11297b021","ssdeep":"1536:J0tWbQ0IWRSv9mTCU5080mcnuvKdwdL4/aC9Mj1FWerIj9uVbxdu6Dx36HMEHmi5:WWbQ0I9z60rmkm/XCJ8Y","tlshash":"92d33c70b210247686ef02ab529ab3c57b6420877500e499756ddc0e1fddfca21a7eef","first_seen":"2025-09-12T00:00:49.073082Z","last_seen":"2026-04-15T17:41:59.494199Z","times_seen":48,"resource_available":true,"data":null}},"time_used":1785,"timings":{"blocked":1472,"dns":0,"connect":0,"send":0,"wait":311,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-light.ACSHASH561c834597fb9bc5aac4021e21e006be.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.189Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/main-light.ACSHASH561c834597fb9bc5aac4021e21e006be.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 16:03:54 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4446a-4a6b0\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":304816,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65302)","md5":"d5c184d9ecde58d2ce2469988898fc93","sha1":"b2876968082e83f438cd27455900c6c7edd7ce93","sha256":"467e918884614801fc889f579cdca00ed6ae718c81fd5a2746ed4cbc53837245","sha512":"14c3d46c382d22505f0bee37446ad6f8ce7991a5929a8f1708c09d1840d26d6736dcd1b9339d2e438d9aca52d995fc1dff5391db357138790754075cd94b1b25","ssdeep":"6144:akc1b3b99G9gR7N1xf6iKyqsNHHlYXklLHdkmBHV6ysv9S/NYWme0QWufThQWB3Q:R8vfThQ","tlshash":"b754c7f9b5612059a763c13d64d07b78422e2599f315bdbbf1c372ac8f8a38e1122b1d","first_seen":"2025-09-23T19:38:24.245487Z","last_seen":"2026-04-15T17:41:59.465516Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1074,"timings":{"blocked":291,"dns":0,"connect":152,"send":0,"wait":303,"receive":162,"ssl":163},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/site.ACSHASHd1da57737f7587d5304532e6afd0b53c.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.253Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/site.ACSHASHd1da57737f7587d5304532e6afd0b53c.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-1901\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6401,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"d1da57737f7587d5304532e6afd0b53c","sha1":"c1d553b50560889c211d001adcbdfc7c8ceadc2f","sha256":"2a3cf587639bebf9cd9b3f948bcdea77de53a2ac783ffae2dff648be0edb00ae","sha512":"0473f4a57252b67b77d1e7af638a3253f1d4e815d7b998bd978e79d8dbc21a300d72463734044f43b1e227483317b7c749e7ca8e7715991a7f735e4693a6a58f","ssdeep":"192:OvXH2X1H7ySlEus2WpWG3cN4pHR9XXjRCVhGBgRswHNRT:OvmXZ7Sus2WpWa7px9XzNgsKD","tlshash":"99d1512e21e09ef3146b646fa34bd1c8b260905f3105da08bc4ef7690f6ce7456f6ac9","first_seen":"2025-07-24T21:09:09.189417Z","last_seen":"2026-08-11T17:29:35.517916Z","times_seen":540,"resource_available":true,"data":null}},"time_used":1327,"timings":{"blocked":1172,"dns":0,"connect":0,"send":0,"wait":155,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/2b-8e0ae6","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.257Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/2b-8e0ae6 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Length: 141432\r\nConnection: keep-alive\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nETag: \"22878-63e9c92bdda80\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":141432,"size_decoded":0,"mime_type":"text/plain","magic":"JavaScript source, ASCII text, with very long lines (41545)","md5":"a65b505079882980bfe9eb49a15e7a7c","sha1":"95421822db52c1f6fda5bd7e1cac65c253ae0c05","sha256":"62d309c44fb75db449fca08eec45544430c51b935f2b96de48ee85bee45f5c54","sha512":"ef5c21eb60ec0e45c1a3bc8bb3939a78c08e5efba018dfb58f05c5b361f3cd2648c9156ff9ce1bffbbdbdaeacd1265c4529265bd69b7b8b03d561ef67448068b","ssdeep":"3072:pf4HuF6pxnISCI9d1EwgXA7CiIEMK/xw/:pf4HuOIuNw/","tlshash":"ecd33c99b15835768bdf50fc978f1408b2334429944a6458b82cdded1878e4f21b7ff9","first_seen":"2025-05-07T21:31:43.723137Z","last_seen":"2026-07-28T11:35:36.700754Z","times_seen":947,"resource_available":true,"data":null}},"time_used":1456,"timings":{"blocked":1293,"dns":0,"connect":0,"send":0,"wait":159,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-polyfills.ACSHASH79ca9118c9426ba6ea5a615503dde6e9.m.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-polyfills.ACSHASH79ca9118c9426ba6ea5a615503dde6e9.m.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-ef18\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61208,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (566)","md5":"f381d5147c85ee687ea8fbef32c83d37","sha1":"eb654abaf1df5ccb830763d5a40140b5c093c49f","sha256":"2d0832b29f1b3347c4b5046c373a635884b76abaf2de3ff650ee74d8b46f001e","sha512":"cd6b4deb925037a6c0cf4baa5ab600891139d99bfb9173d3f3dd4660d281a6266b5709d53770395e7459d9d2060e37f06295e8f9719a21f3ea8433d9e2206e65","ssdeep":"768:qCLbrNurYZRrfHvWCOqbEC9EbivVZh3ctWNwtBSg646z:qC/purwhfPWCOqbEC9EG3sDP6z","tlshash":"d7532b9cba26b07297e762b6403f020bb637557ab404c0d0b158e8f52db8e5e457bf39","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.514413Z","times_seen":455,"resource_available":true,"data":null}},"time_used":909,"timings":{"blocked":600,"dns":0,"connect":0,"send":0,"wait":307,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest2.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest2.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:57:52 GMT\r\nConnection: keep-alive\r\nETag: \"68c39a40-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":1115,"timings":{"blocked":460,"dns":0,"connect":0,"send":0,"wait":151,"receive":504,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-aem-styles.ACSHASHd66c468f4ca17e83ccd97a4518b3e814.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-aem-styles.ACSHASHd66c468f4ca17e83ccd97a4518b3e814.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-27\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"d66c468f4ca17e83ccd97a4518b3e814","sha1":"2e657440f653da65e699ac9230d82faee414d8a5","sha256":"8e1ce663720f6afb2dee29b587d3f7559ea89bc622f966120c9f108172a5c866","sha512":"fc012a375f871892839d547d3fb3d38b58c2542b0f32fb005a7cadca7ecd676d1626f3ce79e2dd24890b02162ef7c2b8a877049ce7865b9b83c7ffda9c40fbbf","ssdeep":"","tlshash":"2a90047171d4f010cf515301005031347414c400d143445545453f1441c0f415d54f14","first_seen":"2024-03-18T17:19:56Z","last_seen":"2026-04-15T17:41:59.527559Z","times_seen":447,"resource_available":false,"data":null}},"time_used":759,"timings":{"blocked":600,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-click-group-telemetry.ACSHASHf25fec6821f63d701a6b62.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.261Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-click-group-telemetry.ACSHASHf25fec6821f63d701a6b62.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-980\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2432,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"f25fec6821f63d701a6b6291a4011894","sha1":"1260ac884282372b86f3a600ba8903ad75983e67","sha256":"dd8619be444cce5f8db053215bb018c0bbc09af7baa9e66618bdf041b0a2e09c","sha512":"1f3c21e2c32dc8362a1ca12801fec56bd22cdaf0bb7fb8d0d118348019eb843a63a171154bb0392dfee268c5727f47cf139144596c0dfb7d12125ce659db35c9","ssdeep":"","tlshash":"7e41af1636f261e1021750ee03cb9185b226e58bb649d58cb99c97180fa9e71b5f3bcc","first_seen":"2024-08-06T07:44:39Z","last_seen":"2026-08-11T17:29:35.506339Z","times_seen":1164,"resource_available":true,"data":null}},"time_used":1584,"timings":{"blocked":1435,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-contact-sales.ACSHASH7a524381cfd41a23a665d6a325c6f1.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.267Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-contact-sales.ACSHASH7a524381cfd41a23a665d6a325c6f1.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-32e\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":814,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (513)","md5":"4c899bc9d9bdc8ca4b7ad57788766bc6","sha1":"40d245c6b5539095a3750f934a918245392b0b5b","sha256":"086661942e79a55f9ef888bc5b8ab393532691c20eef554d2b3d9e93b8420aed","sha512":"d35fb28253e919e74f59bca3d1d0a4cf33976cedbe0d34e2ba72235cf7c243077d540df7b41b6d4b76d1bdd11aad4ce985affb3f7b2d12af3393146a713c6ed6","ssdeep":"","tlshash":"95016f6c5134c5b756fb099ab20ea38071f1a06af407b8e4184d8c1d2aecf9f0e32981","first_seen":"2025-01-11T07:57:08.989952Z","last_seen":"2026-04-15T17:41:59.545943Z","times_seen":139,"resource_available":true,"data":null}},"time_used":1748,"timings":{"blocked":1597,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-icon-featured-collaborate-24x24.svg","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-icon-featured-collaborate-24x24.svg HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-72d\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1837,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"831aeaa2a97582b14c9659f3a0c74352","sha1":"a0b6db543390122c611e90c0fed11a79f714872d","sha256":"31376c473affd3be5d4c5b67cb670bb2782cd9b8c543d11d25d346d4ba9d9bab","sha512":"dff63a085e70d5646ed6b66f42a3fd86729944c6ea578ec8b7079e6210b7c09824eab21c56e7e45227d3824c9ca9e3026716aff265f53affcf4da74dbfc0549f","ssdeep":"","tlshash":"933142cc6b3886a0a46083aff56490af760da0e569430670c95a1f4df40b9f9cf16acb","first_seen":"2024-12-12T19:57:47.877269Z","last_seen":"2026-08-07T01:12:06.940891Z","times_seen":58,"resource_available":false,"data":null}},"time_used":1200,"timings":{"blocked":1048,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/publisher.ACSHASHd04116a7de4f2a26cdce768dfe83c5b0.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.192Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/publisher.ACSHASHd04116a7de4f2a26cdce768dfe83c5b0.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-291\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":657,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"C++ source, ASCII text","md5":"d04116a7de4f2a26cdce768dfe83c5b0","sha1":"83a51ad446f944c97493022a32cdc51a95b3fd34","sha256":"2b3c1170ccac9b1e2b0c70a6d2a6d8c290cc55f3d7eea099b13d172289553b67","sha512":"ea8440395285519dc7fd4dd6f8f71357c01f01120606085642eb9c8e4d21b2223ea754fcd324e395b8acaeff27105c313ba4a204c152e0c18fd48bf5f74a9bea","ssdeep":"","tlshash":"130178c3d8f4a89362377ca5ea048790e146b35703c8ac447ede85bc5f573930b116a2","first_seen":"2025-02-07T17:08:29.255155Z","last_seen":"2026-08-11T17:29:35.510685Z","times_seen":1028,"resource_available":true,"data":null}},"time_used":784,"timings":{"blocked":292,"dns":1,"connect":152,"send":0,"wait":169,"receive":0,"ssl":160},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/msochead.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/msochead.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-1199\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4505,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4505), with no line terminators","md5":"67f09a596ab630350eee9e480bc52e36","sha1":"5646caa7a7daa9a6ccd21655819f4656c05b619e","sha256":"791c9bc1772cc666eb226e5df7060b1107cdddd2ed2b2f1f534b920ef0a7e5f6","sha512":"28d66366053b99d0a1371165a9c1a5db38b946e2acc76ac111086bc043b75155775b8dcd450fabad4abd5029b516a3f8fa21d0b71947edc752452190d0ecebf7","ssdeep":"96:i+P+GSWasaYAj2DKeDmU5YB0pCLW2sR9R/Ohd:i+P+JWasaYAjgRDmBBqC62sR9RW","tlshash":"a39165a2f92004ba6ae7432d40d6f3f56f1cf591c78e9de568c2622475c35ee2023d4e","first_seen":"2025-06-26T01:26:55.648572Z","last_seen":"2026-04-15T17:41:59.489466Z","times_seen":144,"resource_available":false,"data":null}},"time_used":1037,"timings":{"blocked":886,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/base.ACSHASHbbf19119afee3c72253b59e12c3b5503.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/base.ACSHASHbbf19119afee3c72253b59e12c3b5503.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-3381\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13185,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"bbf19119afee3c72253b59e12c3b5503","sha1":"e6cfe58feb83cc077f5d59fa96b3378ec7e0819a","sha256":"ce176b847d387500efe712b8cc451dfa985489cd38195d1dae6772e8661fe228","sha512":"4d11ac2de4ffc4d1d16bd77cd0991bd8809585327ee34a0ea31d9f6ebc75cca9bcae050a961a256081b3c63c1a3165f938a58a93fef2a6197f5e7444263e8997","ssdeep":"384:tSsg7eeMXX3/4WKtr0Ai6QIG0LHCiX+JLBJ:csMedHgWKtqEGYiC+JLBJ","tlshash":"b342964927f2717641bb103a6bdf2a81f935524f32c4c9c8bd4c6f781f19e1182a6af6","first_seen":"2025-05-28T04:59:18.032556Z","last_seen":"2026-08-11T05:10:21.81872Z","times_seen":661,"resource_available":true,"data":null}},"time_used":1191,"timings":{"blocked":1038,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/wcp-consent.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.257Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/wcp-consent.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 16:06:06 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c444ee-442a2\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":279202,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63880), with no line terminators","md5":"d3cb898c8a0993331ee714b575fdf9d8","sha1":"54447d09be292066d833fda36f89db17cc3b3458","sha256":"9cd4693c8eeec654b06636d721ae14f4c4dd338a2e35c70fb2c04b76315085a8","sha512":"63f67230320f594c3cfae6a217bbbb368931dd55dbbd0d3921c6c44a04f7866fbe851f0df4f0b1668281da692f836563d4195ec7b624fdba43259fb892b4caf4","ssdeep":"6144:dIYsZZWWI0BDqL9W4sC6Hdo7NjIZjIZP0hZRWLF9LmSF/EI:dIYsZtI0BGoHdo7NjIZjIZP0vC75F/x","tlshash":"11546d7fe3c420ad03012346b885bb39ba1d067d7691d6c5f84ca57d23c2b95c52abfa","first_seen":"2025-09-23T19:38:24.289636Z","last_seen":"2026-04-15T17:41:59.460568Z","times_seen":18,"resource_available":true,"data":null}},"time_used":1439,"timings":{"blocked":1282,"dns":0,"connect":0,"send":0,"wait":151,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest2.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.104Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest2.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:57:52 GMT\r\nConnection: keep-alive\r\nETag: \"68c39a40-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":718,"timings":{"blocked":65,"dns":0,"connect":0,"send":0,"wait":154,"receive":499,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASHbf7b336dbb370c984e1bf59b1a980d86.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/v1.ACSHASHbf7b336dbb370c984e1bf59b1a980d86.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-6b4\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1716,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (590)","md5":"4cffc2c9b55f8bde649e0d2535a1eebd","sha1":"2aaf4df1e02ed4f5bb48f00a7423f748bf544e0c","sha256":"7bb50a050792f761855cc330e0248d037b37dd68fd23fbb7db8a7e8694f50a94","sha512":"599c87219b7e264cff8e6951192c691e26dffa88efc607edfe9205f1bb08da28fd61b508fae93652be36be1ada57e50661490925b247a43c3eb7f24d8ca0c8d0","ssdeep":"","tlshash":"4c312159fa89f01107638666ab9f150bf134d61163c4f3709380d1927e9069f99936c7","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.480979Z","times_seen":780,"resource_available":true,"data":null}},"time_used":906,"timings":{"blocked":752,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/LinkedIn-29.avif","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/LinkedIn-29.avif HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/avif\r\nContent-Length: 593\r\nConnection: keep-alive\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nETag: \"251-63e9c92bdda80\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":593,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"056f2a3100e2202498622286a5ef3042","sha1":"8dfcbeafa96f044c97e72db48a4bfdaae3397daf","sha256":"19812d572cd1a5d2c0eda87947faa5ad82a7ab4f3062835fbef213a2efda12d1","sha512":"3a38427157ad9bfab2f335e4a829279d3c9aaa4a38cdefd0846f134fe4e011ec9306096b30c8f861baa7b7e70653edff5c94fba74f43bbc62a41f8ddf433b9a8","ssdeep":"","tlshash":"d9f0c938b3a22e81e8194339595b431a0806e13a27ebf80eca597b28de215ff4c05fd0","first_seen":"2024-07-30T03:33:51Z","last_seen":"2026-07-28T16:03:08.09896Z","times_seen":192,"resource_available":false,"data":null}},"time_used":2573,"timings":{"blocked":2416,"dns":0,"connect":0,"send":0,"wait":157,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-featured-1600x594-1.avif","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.772Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-featured-1600x594-1.avif HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/avif\r\nContent-Length: 18077\r\nConnection: keep-alive\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nETag: \"469d-63e9c92bdda80\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18077,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"422bce91f87866673eff82bf45c9604a","sha1":"1f8a1607cb3c0b8c4454b5880cdf3e287d5c894a","sha256":"a1f3b418ba4f3e582b8a2aea161aa92577b21d085174ca8fa74d533af13c4392","sha512":"acc88349cb78653903f37c66f7b193de914ed483eefea02245b86b8e4cd1dd76512d1569ffbedc0eb247a1903e3c86d0bc8640405fda7e1e62d4ceb0803c9e91","ssdeep":"384:Of5jB8RvbeKGNol2gXCC40U/Qu1itxPiUAxNjOkR:yl8RbeKKolYGqnCixNpR","tlshash":"3f82c0b46962870dcc5af9717acc1f078353218195fe98146d1e3c082a6abdeac01ce2","first_seen":"2024-12-12T19:57:47.86956Z","last_seen":"2026-08-07T01:12:06.927088Z","times_seen":38,"resource_available":false,"data":null}},"time_used":898,"timings":{"blocked":721,"dns":0,"connect":0,"send":0,"wait":176,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/launch-41185cd0b005.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/launch-41185cd0b005.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-d9aba\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":891578,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text, with very long lines (32739)","md5":"e93e0519c88151676535f31e8a4e6691","sha1":"3bd4f0140d05a3ee08a9e4f55f8fd9420cdd201e","sha256":"52a0d1c53dc58e12a59c76609b5946b7790f28b8f88dedc59eb72cda448ad354","sha512":"2ef198231f3645123d423629e6f972b6bd90d5fb38aec66a62268db901eeb6ba72b24cfa5421f019aa2a3f2b6c3363b08ce6adb19e8f58e5d848277e99a89f3a","ssdeep":"6144:3ScZL0c9YNyCLvmANHSaxbVjqxxk9cuNZchdwwOT1fEAHwPos6/pFvpqu:Y/vmAlSaxbaQZchET1fpHyos6/rvp3","tlshash":"b81506cbf600147552ee21aebbebe185763437889014c410b89fcd5b7b75e44f0aabe9","first_seen":"2025-07-03T00:12:13.398166Z","last_seen":"2026-04-15T17:41:59.477419Z","times_seen":138,"resource_available":true,"data":null}},"time_used":463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":166,"receive":297,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.191Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 16:02:34 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4441a-a8d89\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":691593,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65338)","md5":"72533fbb239e8d845185452878560ba8","sha1":"0ee12cfc5bbfe05f9a8d201dedbb65760b735e85","sha256":"660e2b39f147f9dc841beac517d30b11cef5e3fb2224fa67eb58b6b65ddd31b1","sha512":"e9bc1b00ffb423173eacc61f0d2551e1b37727b6b577380b4d0acec12d900169de2134b1ba308130dbee77ee24c1a6eeb7c5bf02beeaa2a2ea44dd3db3a5eab4","ssdeep":"6144:MwWdhqVZrdICH1BqTZXire7Dqsx0C9i98nrBsMJ6KbmS8yL:+q3Kt","tlshash":"fae4c8ac76b062fe3a1352379296f7296128b8615f5035e1f593b02d07cf7e301a6e6c","first_seen":"2025-09-23T19:38:24.209961Z","last_seen":"2026-04-15T17:41:59.538138Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1226,"timings":{"blocked":291,"dns":1,"connect":153,"send":0,"wait":300,"receive":313,"ssl":161},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-jquery.ACSHASH75d0cb3e9ff9fee40f5ce5fd93c17fb2.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-jquery.ACSHASH75d0cb3e9ff9fee40f5ce5fd93c17fb2.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-16b22\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92962,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (889)","md5":"35986a813756f39ab6b922979ffedb03","sha1":"c8e2213bbafaf535da9c6676f3dba43449e4d15a","sha256":"e2d92bdaad925c6d355331a338384ee3ff82492352975dd4efda791aef4ab3f5","sha512":"289f1c432e73f611d54eb1130013174174222a0c5eef8e2464c5fd51ee33dc702326eeeca80b2aae213db2fccb149297fc37cc9a0b6cf6e928a66bc27843f930","ssdeep":"1536:wB4vGoYlmQr+IDv1Ty/6RsSz5TGF/46nNUgDbC03vu9FnHKDfa6Z/VUhdIKq6Tjv:wqxNrNG9FnHKD/oIKq6Tjv","tlshash":"ad9319edb6c771628ba734b850bf010bf1bb599ab04c8850f055d4e4bd74a4a50bbf2d","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.539793Z","times_seen":843,"resource_available":true,"data":null}},"time_used":890,"timings":{"blocked":733,"dns":0,"connect":0,"send":0,"wait":155,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-localstorage.ACSHASHb884ef4864d6867bd00aa4a7a5cfb36.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.222Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-localstorage.ACSHASHb884ef4864d6867bd00aa4a7a5cfb36.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-c2c\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3116,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"C++ source, ASCII text","md5":"b884ef4864d6867bd00aa4a7a5cfb368","sha1":"d45d8bd33632588a913575910b3d0eabd5ad3828","sha256":"177f6b14ceb87d301946d00124195ebb755a452ba40abca5cf6a4e77e52222f5","sha512":"375a8412459bbe64b6024c462d996b4b48de246997ba36f5e26379f163d5faca69cecc79e4fd246f92079a23dcd36ac2e8058d2c9663ba9d31c07c6786269581","ssdeep":"","tlshash":"055149467ee213310d97119deb4e7090e03c661ba25d8a59bc6f13d82f4872d63e43e5","first_seen":"2024-01-17T11:29:48Z","last_seen":"2026-08-11T17:29:35.429277Z","times_seen":986,"resource_available":true,"data":null}},"time_used":1316,"timings":{"blocked":1167,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-httpclient.ACSHASH726084fbb35cdb34b4b6a7f50889354b..js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.262Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-httpclient.ACSHASH726084fbb35cdb34b4b6a7f50889354b..js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-9f59\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40793,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (868)","md5":"626f44e8649ae3ad321f85283fbcf42c","sha1":"1e1838fa037f19903512342f06856d80b0e659ed","sha256":"4c12d6686db8795401dc2f0114f91c4ac471e24a616229ddbab251bbe5a5649d","sha512":"6cc727ad42a1ad0269a600616c5fe7b9f7744da80a5845f01b489eb5ead0bd530dfed00733cb89164863514ece598acc1f6b12d5e06aea2c0844d69e82bc3243","ssdeep":"768:R/IeD34NYBHEurgK/R1vfz+DGe0BWU1OxLhRMkcT5xQIdK9sTeQFH1:R/D47u/RFqcWcQWsW","tlshash":"7f03e7cdb692f0624367b1b0d07f160bf63a5958a48c98a0e114e8e63cb941fc677f6d","first_seen":"2025-07-31T16:39:29.840984Z","last_seen":"2026-04-15T17:41:59.510549Z","times_seen":33,"resource_available":true,"data":null}},"time_used":1601,"timings":{"blocked":1447,"dns":0,"connect":0,"send":0,"wait":153,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-icon-featured-meet-24x24.svg","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.774Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-icon-featured-meet-24x24.svg HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-b81\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2945,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3236cdac34962730a4a756ecef3f3d50","sha1":"7a55b3d06f8748370dbd1d49e82acd3722bd0eec","sha256":"6693ef016fd8f4a720ec2ce02bb2d6cf471ace9aed95c3187bb7b2e689ba1765","sha512":"2ec3de8b5eec31b8eaa8143462c582cbf8b26d3cc2a295461013919780523abf65ce63c6b042e5af4c84240172d4a827159ffed991f6b231874fcf26a3c08be1","ssdeep":"","tlshash":"195130fd763407e9f93417c56ef228ce611a80f1da625670c2a6df0af5db8588e45c12","first_seen":"2024-12-12T19:57:47.872355Z","last_seen":"2026-08-07T01:12:06.875902Z","times_seen":58,"resource_available":false,"data":null}},"time_used":1068,"timings":{"blocked":917,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-icon-featured-call-24x24.svg","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.775Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-icon-featured-call-24x24.svg HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-641\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1601,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"77e9e7c69f23821ee79746290aee0366","sha1":"47d337bdfa45476e9a6f3b1d426691d3c003076b","sha256":"235a74286d92933b70775038f4a960172d7ebc7640734e428e3a846b561599ae","sha512":"b86e2ee3eb663228e79b09fed406bfa9b988856d206cd17bf38a5718c1f1a2a1ee8950ff376953990e64eb3bf65bc7c6666e086314955b029cfcbadd3312da94","ssdeep":"","tlshash":"243178fc63264779c442c7c1db8106843d5b74f7b9805e30c791b66e701e5595658cda","first_seen":"2024-12-12T19:57:47.874874Z","last_seen":"2026-08-07T01:12:06.892302Z","times_seen":58,"resource_available":false,"data":null}},"time_used":1178,"timings":{"blocked":1027,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-icon-featured-chat-24x24.svg","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-icon-featured-chat-24x24.svg HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/svg+xml\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-5c9\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1481,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4c3dd727f103263c268ff088ae87b89b","sha1":"5926007be35339cd45c787a7589e8a28bbbce609","sha256":"1336a9ac5090c7f963f97c8c3b8046b25c64f29219d4911f05420d6b59cd772d","sha512":"b08ce8205d9a0d25add361480b67891bb501e321706af9a1b9234349f981b5d2e5c84ae6c5906cebbc3bf68978d40c625b90997863911513fed00ec5d3873d4f","ssdeep":"","tlshash":"8f3140ef97ad43d4a884e345df247444160e30eb38c38e64db7d691938a93aaec1bdc1","first_seen":"2024-12-12T19:57:47.87938Z","last_seen":"2026-08-07T01:12:06.878643Z","times_seen":58,"resource_available":false,"data":null}},"time_used":1196,"timings":{"blocked":1047,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-27T03:11:33.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:33 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 47993\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Adobe Experience Manager","description":"Adobe Experience Manager (AEM) is a content management solution for building websites, mobile apps and forms.","website":"https://www.adobe.com/marketing/experience-manager.html","common_platform_enumeration":"cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*","icon":"Adobe Experience Platform.svg","categories":["CMS"]},{"name":"Java","description":"Java is a class-based, object-oriented programming language that is designed to have as few implementation dependencies as possible.","website":"https://java.com","common_platform_enumeration":"cpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*","icon":"Java.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"C3.js","description":"D3 based reusable chart library","website":"https://c3js.org/","common_platform_enumeration":"","icon":"C3.js.png","categories":["JavaScript libraries"]},{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":516272,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (9732), with CRLF line terminators","md5":"2f261b52dcfffa26fc537cfcdc12bc52","sha1":"18dae8b5a66eaa8acf0c5bc5f747d425a924ca1c","sha256":"aeef6b0e4c142df36ba5a46868c1dfa5c71b13da810ad6c910a56d865516274f","sha512":"591b96406ad18faf515ea926b69178aeef4f5e5da4ffbc0cfcf5a4674c23d9129db3505aade65b52fe8f1bcd9f62432d1f719538e09e88577c4aa8737f7a1e4d","ssdeep":"1536:JiRB8+DduP71N96TiQ8ES+6Kh6xSEqdl0Q4B:JiRBJDduP7kiQ8EH6Kh6ETla","tlshash":"6ab43d71a0326c3e45ef32e5c5666b4aa283e343db4303e5b19f23b717d2e65ac97058","first_seen":"2025-11-27T03:12:15.896501Z","last_seen":"2025-11-27T03:12:15.896501Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1172,"timings":{"blocked":352,"dns":51,"connect":151,"send":0,"wait":302,"receive":155,"ssl":159},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-action.ACSHASH44700d76f3f63fa33f30039bb9c74b39.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-action.ACSHASH44700d76f3f63fa33f30039bb9c74b39.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-cb\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":203,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"44700d76f3f63fa33f30039bb9c74b39","sha1":"f68b158102c2575081cb4308e4fea483e1b9d604","sha256":"fd73c7131fea30896a95bc1d0e9f08f383fefb03730db9a433f43b319eff33ac","sha512":"2665d21274db60a9bc6bcc7100df57c2ee0e2264601a295902cc0e958cba2b198e4c1ab6291947a8f33dc46d42ae0e1f586369cb3f3b011c751c81efa755c234","ssdeep":"","tlshash":"4ed0121c624c9308ee270b5c303d2d2b1eb932802ad41504849457937f8f241b8c0845","first_seen":"2024-05-28T08:32:49Z","last_seen":"2026-08-11T17:29:35.50841Z","times_seen":828,"resource_available":false,"data":null}},"time_used":738,"timings":{"blocked":587,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-contact-sales.ACSHASH4a1a21c1176e98acf994a20632951.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-contact-sales.ACSHASH4a1a21c1176e98acf994a20632951.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-41\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"4a1a21c1176e98acf994a206329519ba","sha1":"556073a5577dd99996ab18050a8b0e95eb0d9f82","sha256":"c70dcca4600ef426081fe5cb273bf1ad8cfba4e42c0d72543070b110a1559c50","sha512":"68135c103e25d17c10e48fee68c642c4d15d94d96fb2a8de4d2938fb1661753ef99534f4bc21dcae6d941835005a94ec1a3cad22a6f5af347b8ea0859b1cbebe","ssdeep":"","tlshash":"06a022b3ee03000c000a080ae202c0280b3030283fac38c308c0b082ab082c80030c0c","first_seen":"2024-02-08T15:16:52Z","last_seen":"2026-08-11T05:10:21.873696Z","times_seen":1125,"resource_available":false,"data":null}},"time_used":1748,"timings":{"blocked":1597,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:49:32 GMT\r\nConnection: keep-alive\r\nETag: \"68c3984c-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":602,"timings":{"blocked":124,"dns":0,"connect":0,"send":0,"wait":152,"receive":326,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-events.ACSHASH4c28b55b872280fe389b01920b5c9315.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.197Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-events.ACSHASH4c28b55b872280fe389b01920b5c9315.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-cd9\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3289,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (534)","md5":"32ae7925b14231b848f5318c86e3f90d","sha1":"aa4142b301f38d8a1bfadecefd9953ece384f562","sha256":"b17fc6c97200b46958998570610cd3536f0617f7ea9593dd3e6d6f4eee9daf82","sha512":"640079d7f0b679f1ba94762ba000e3c7f12f8a950c43959a19c37a8b11903e4ef83bdff677286f233043b285043bd2f1a1e58e69d88ee7ac63777efff32f8e36","ssdeep":"","tlshash":"7561ae5926540ff898da047df36f77aa757224f2a16100c0cb2c9c784e68e48916dd2b","first_seen":"2025-05-28T04:59:18.074898Z","last_seen":"2026-04-15T17:41:59.530504Z","times_seen":44,"resource_available":true,"data":null}},"time_used":605,"timings":{"blocked":451,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/site.ACSHASH99db8a371e5b97000cf74f4235f8ffce.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/site.ACSHASH99db8a371e5b97000cf74f4235f8ffce.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-80\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"99db8a371e5b97000cf74f4235f8ffce","sha1":"a36aa7bb8a09acdb1ea4e9e733d20abf88ba5603","sha256":"0070a2dda91848c280666a96ae521ba4908af8e0bf1432d0fdea37826558aecb","sha512":"06698a044daba087c2346799dea8fcd899e59b7bdffeca156f708acba58431b0727f4f84e14cd51b1e45a1077b774e370416175434fee1d5b99c479d76dc7e5a","ssdeep":"","tlshash":"1ab02b4243783422340f017330d440c00bd4d00ac1234b612201c318f2d53cc0dd3079","first_seen":"2025-06-17T17:33:16.344002Z","last_seen":"2026-04-16T17:17:19.893647Z","times_seen":2043,"resource_available":false,"data":null}},"time_used":1183,"timings":{"blocked":1032,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-product-pricing.ACSHASH1db38d888c5d592f8fcc31c2e4ae.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-product-pricing.ACSHASH1db38d888c5d592f8fcc31c2e4ae.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-1d9a9\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121257,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"de9b8e2b4eed09785efe9462d2630060","sha1":"2ea766767150c170f7519e719513aa1ad0ad4723","sha256":"d737776236ed1a8bdfcdff43b13adc8190c3c88847b3b69bc26c6f73b4bebdc6","sha512":"f17b6590a2f217c7a184d0030f4c56600da96616a36dc584b2b653222f40f090b6fb2dd66307df06677beff1ebc69b3c0b981f0e8366528c1f1dddba51102579","ssdeep":"1536:ZJBBrkzb7l2nUcNGCHjqjYvYWIZFEs6+Qfamj0pYAL3oDpZA15pepKMVOiKiU3GL:a0jqjYvgU9f1","tlshash":"abc371e641f41f23046e1269dbeabfcf79ae1017a76a90d23c8d12d80f76a2443b55dc","first_seen":"2025-06-03T08:29:31.327546Z","last_seen":"2026-04-15T17:41:59.485084Z","times_seen":33,"resource_available":true,"data":null}},"time_used":1202,"timings":{"blocked":1047,"dns":0,"connect":0,"send":0,"wait":154,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/faqs.ACSHASH3e2bbf17b5bf77ae832449b6e06073ab.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/faqs.ACSHASH3e2bbf17b5bf77ae832449b6e06073ab.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-307\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":775,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (509)","md5":"fe68b59e840a1a274393b3ab03c85e96","sha1":"c8c1b1196b05e9adb6d342390956a231920b2017","sha256":"9f01aea27d73c422ac5e7e87c2f7f3ce364e1f940faeb6cf3178b5e13cb43497","sha512":"58921a6195363008a3dd65af8d115828c3f93fb23cccc9fb5d2faf7af55f5779efba947b990dedf5b2751f3ed0ba4071f006873ffb68f77cca3c8d565092a90d","ssdeep":"","tlshash":"590190faa7d52c3510b9d798434d7f85e22ab0199001cc78956bcb5e2fa0f59b5f1870","first_seen":"2024-10-06T09:12:11.176897Z","last_seen":"2026-04-15T17:41:59.515871Z","times_seen":142,"resource_available":true,"data":null}},"time_used":1319,"timings":{"blocked":1169,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/Twitter-34.webp","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.255Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/Twitter-34.webp HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/webp\r\nContent-Length: 926\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nConnection: keep-alive\r\nETag: \"68c4409a-39e\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":926,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7cf5e36d5c77e91a387a3f24bd7476a5","sha1":"1571745948be01cfb62ecb08fcb91aa4b095215b","sha256":"3d558977f35b8ed9e4def149b1fff81a0843247dd4897d0ced73a867b1c425a1","sha512":"1efdab3cce2edfe038e3777904c87403f30bee26b399d2dfbe0f7db491058c792b67d241ab05182d5ade86e7d549a8827cd04d317839f1b38b450ca81d30d856","ssdeep":"","tlshash":"4411b763f31685cbd3be9cc8176c8b080ca612da0b55578ed5af07f342a589f6376087","first_seen":"2024-10-14T23:47:00.602545Z","last_seen":"2026-08-11T17:29:35.512383Z","times_seen":214,"resource_available":false,"data":null}},"time_used":2568,"timings":{"blocked":2415,"dns":0,"connect":0,"send":0,"wait":153,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-action.ACSHASH02f6c2571e097b3a29e66c43eeddac08.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-action.ACSHASH02f6c2571e097b3a29e66c43eeddac08.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-247d\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9341,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"0536048a262465cb22b560c666018a77","sha1":"332897a6f8e050baac8fef385bf05b3cbab14763","sha256":"5b748160125fbe8ff151a19411de668c0c2cc4509bbacf5de158f3e4f7908807","sha512":"acb7320771c8b6cb70b3b9d62496a271956933d6c81601d44cd85a90378391dd1ad5bbca656e295aec9de2317427bb617d7a8877a4b7351efa4f9987fd1d1b7e","ssdeep":"192:3lGqnBqPmIa4HAb1WWe13GgkNb2c6cN0JL2xf98k3lPcJtQIgGySjye1nGEZ8Uhh:3l/gPmIaP3U2gkNCcUJL2xfN0Jt6G351","tlshash":"2412942d05f34271833728bda30fa390e1ba21573268d8997d2c96546fdcf2996f36c9","first_seen":"2025-04-01T07:25:59.502365Z","last_seen":"2026-04-15T17:41:59.473264Z","times_seen":65,"resource_available":true,"data":null}},"time_used":1327,"timings":{"blocked":1176,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2","fqdn":"c.s-microsoft.com","domain":"s-microsoft.com","tld":"com"},"ip":{"addr":"96.6.17.223","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoft.com","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft Azure RSA TLS Issuing CA 04","organization":"Microsoft Corporation"},"validity":{"start":"Mon, 21 Jul 2025 18:25:48 GMT","end":"Thu, 16 Jul 2026 18:25:48 GMT"},"fingerprint":{"sha1":"53:8C:3F:30:23:61:D8:6A:C5:D2:EB:98:33:02:6B:24:74:8A:06:8E","sha256":"93:A2:1C:36:17:A3:04:0F:E3:C9:48:67:9A:30:C2:2B:DC:BC:76:F6:4C:32:07:0E:10:E1:EF:D2:03:9F:CB:57"}}},"request":{"raw":"GET /static/fonts/segoe-ui/west-european/normal/latest.woff2 HTTP/1.1\r\nHost: c.s-microsoft.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://microsoft-teams.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 34052\r\ncontent-type: font/woff2\r\nlast-modified: Fri, 10 Jan 2020 19:09:43 GMT\r\naccept-ranges: bytes\r\netag: \"588d483e9c7d51:0\"\r\ncache-control: public, max-age=168444\r\nexpires: Sat, 29 Nov 2025 01:58:59 GMT\r\ndate: Thu, 27 Nov 2025 03:11:35 GMT\r\naccess-control-allow-methods: GET,POST\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34052,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34052, version 0.0","md5":"36397a3bc139c6e9f81d383f060f080a","sha1":"3f4f86c10920d4ed345f4858b6cde9f93e1aeb81","sha256":"4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b","sha512":"7fff4870e9142e6e1921f8dd78e3b049547ec1d540efe573c2938f8b855db61ba908fa9d3c8da1bb2aae6d95217a586d256b9ea2bd8a8f706b1db75bc21f2cb9","ssdeep":"768:WHH8jjaseVFXnmQ8njOkV5c4d7DOgx1J89JzHNBbFOlsy0kQ6lhe:kH8jj3uWxKe5c4xz69hNalP0kQ6lhe","tlshash":"9ae2e155279c3669bc505e7f05bc2586072ca2d6fa7be0e90bb9d05333ac69f24cde04","first_seen":"2023-04-18T11:30:37Z","last_seen":"2026-08-11T17:29:35.498478Z","times_seen":12672,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":66,"dns":53,"connect":1,"send":0,"wait":2,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-light.ACSHASHfe9d5283cc0a38f995b64bf0f39192eb.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.195Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/main-light.ACSHASHfe9d5283cc0a38f995b64bf0f39192eb.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-6671b\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":419611,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1999)","md5":"8197ef94674599aa52224128f2503e68","sha1":"a6f2244ccc50a9ad24949b753618685de96da273","sha256":"cff84bcfa285e077533055802840aad0ea2c6e07993e7d7b90dc19a596d26f6b","sha512":"9d08aa1e4f2f6a48e776168e97e8f341c2184a5fdde1b4f501b908c7ea48a2a0286e9106ae4b5a44816d8ca618610008838871566334f4bdbbddf56ca0a78cc6","ssdeep":"12288:wDxREkZQKdaFA/RIc3f+u2wc/WVKSjdJjfMNlR48tmbK+2pA9XDTotHd9:EREkZQKdaFA/RIc3f+Pwc/6KSj7fMNl/","tlshash":"5e94c70837f2227640a7716e5fcf9101b230404f660add987dacdaa41f95a7846faff9","first_seen":"2024-10-04T19:42:34Z","last_seen":"2026-04-15T17:41:59.529605Z","times_seen":210,"resource_available":true,"data":null}},"time_used":593,"timings":{"blocked":427,"dns":0,"connect":0,"send":0,"wait":156,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/ae-f1ac0c.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/ae-f1ac0c.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:51:32 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c44184-29e3f\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":171583,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (64241)","md5":"ba1bd5fd53308f80827168d0c73a620b","sha1":"c34d9c81b7d25161ad1e7afb41d11fcdb7b99170","sha256":"de60433cf949bf9a3a4466d8fc59e7ade507d8b4d13bc2b90b941573e6d64dbd","sha512":"d2937f95f032340d7a0faa5e6ac0c265f60ae05e05d9395be0865d0fb7b437a16894afeb30efc9b6289287fb87de222b4c3d2e8b1bec337490378a3535085b28","ssdeep":"3072:VzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxq:5lZA3mkJeqt","tlshash":"0ff385f2a5b02cb9127b855bbc82623cbb3cf096d55338f6f785a1846ec1445e2db346","first_seen":"2025-09-23T19:38:24.22835Z","last_seen":"2026-04-15T17:41:59.509508Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1189,"timings":{"blocked":1033,"dns":0,"connect":0,"send":0,"wait":155,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/RE1Mu3b.png","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/RE1Mu3b.png HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/png\r\nContent-Length: 4054\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nConnection: keep-alive\r\nETag: \"68c4409a-fd6\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4054,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced","md5":"9f14c20150a003d7ce4de57c298f0fba","sha1":"daa53cf17cc45878a1b153f3c3bf47dc9669d78f","sha256":"112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960","sha512":"d4f6e49c854e15fe48d6a1f1a03fda93218ab8fcdb2c443668e7df478830831acc2b41daefc25ed38fcc8d96c4401377374fed35c36a5017a11e63c8dae5c487","ssdeep":"","tlshash":"d0816d07ff018801919ee9570485507acb618cd1e7f91061a987c825c9b5cf82abcde7","first_seen":"2023-04-05T04:39:01Z","last_seen":"2026-08-11T21:15:38.441737Z","times_seen":12243,"resource_available":false,"data":null}},"time_used":2584,"timings":{"blocked":2433,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/xf-wrappers.ACSHASHd985498fbf0a15ecc2c0b87f29173809.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.225Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/xf-wrappers.ACSHASHd985498fbf0a15ecc2c0b87f29173809.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-2c5a\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11354,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1345)","md5":"d985498fbf0a15ecc2c0b87f29173809","sha1":"0f1e701f469240bdcb9178314a3eb3370df1b762","sha256":"1a8ff3446de247f2018b44b8b78dd36c4664c1274dee520282c35e79b8c447f9","sha512":"92656b8a312bdb4dc50cb7064c0652dc3dc7d1e322f795781a3b194df1c46689f5ca0362eb9db5a54961c77c3b277f840e153639c37d9f439e9dc22e03a18191","ssdeep":"192:dhXrXQXsXfunVxG4Maaa+XHXa4XrXQXsXfunVxG4Maaa+XHXMdXflSX+ov+INY/0:DL6mX3HL6mX3G6dSpGp","tlshash":"2732b53b047511fc76c8492bd3ec716216bbfa580ea814b0af55f63d578ba43632ac9c","first_seen":"2024-12-12T19:57:47.839712Z","last_seen":"2026-04-15T17:41:59.542619Z","times_seen":104,"resource_available":false,"data":null}},"time_used":1337,"timings":{"blocked":1185,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-chat.ACSHASHfa6f56b2d3037982772378233706c9af.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.265Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-chat.ACSHASHfa6f56b2d3037982772378233706c9af.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-3d6\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":982,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"fa6f56b2d3037982772378233706c9af","sha1":"a511b80627bf05c511f348b3c1aaf4f2fa174365","sha256":"be37586e1929ef52245871fb9fb2c2e2a31a14ee9b421439ca67948ec4036188","sha512":"14e7287defbe26244b9c19edae24b3bfe7e336d41fa1ae85142b8ecb18cc20458953b0bbec9e10ef6691fdb059494bfe65269ab47d2a2ac49a84d6ef7f2affac","ssdeep":"","tlshash":"79117ff3b4845239b0e2d314bda6ab6f793560e7b25119f8e478a3328d4f5d62c30d06","first_seen":"2023-04-10T14:19:23Z","last_seen":"2026-08-11T17:29:35.480649Z","times_seen":1326,"resource_available":false,"data":null}},"time_used":1731,"timings":{"blocked":1581,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/mwfmdl2-v3.54.woff","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/mwfmdl2-v3.54.woff HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/ae-f1ac0c.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff\r\nContent-Length: 26288\r\nLast-Modified: Fri, 12 Sep 2025 03:50:10 GMT\r\nConnection: keep-alive\r\nETag: \"68c39872-66b0\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26288,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 26288, version 0.0","md5":"d0263dc03be4c393a90bda733c57d6db","sha1":"8a032b6deab53a33234c735133b48518f8643b92","sha256":"22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12","sha512":"9511bef269ae0797addf4cd6f2fec4ad0c4a4e06b3e5bf6138c7678a203022ac4818c7d446d154594504c947da3061030e82472d2708149c0709b1a070fdd0e3","ssdeep":"768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/","tlshash":"20c2e197c410d15dd123f2b5592b2f6c9a9220ac775e2a2606ce730b1ceeb3253a7357","first_seen":"2023-04-05T04:14:48Z","last_seen":"2026-08-11T13:03:21.371999Z","times_seen":10634,"resource_available":false,"data":null}},"time_used":595,"timings":{"blocked":440,"dns":0,"connect":0,"send":0,"wait":154,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/MWFFluentIcons.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/MWFFluentIcons.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-light.ACSHASH561c834597fb9bc5aac4021e21e006be.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 27652\r\nLast-Modified: Fri, 12 Sep 2025 03:59:36 GMT\r\nConnection: keep-alive\r\nETag: \"68c39aa8-6c04\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27652,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 27652, version 1.28835","md5":"ca021ccd30ac383f134c6f4c6c9b905d","sha1":"5397761812c54a8eded0773843e3e01ae087bd8a","sha256":"175046e68ff8f49a59d8c9d3aa079bed92c6bbe9f17f311d298ae929fc87dfe5","sha512":"c7e661bb905587962a82d9a275346cd67a146112f069f0fd69c1517e9fa36ad1b32c6df2f701e1f8900d7736a94c44011290bed7dcfe12603934c45866848553","ssdeep":"768:7k/OvwqInzJQvOt1TOZ5aKh/ePgmuskVLeS319Cu:7kywqInzB1Kv2PgVN18u","tlshash":"4bc2e15e7831b06c9e40849e5db3b0bcf30b9bac1381c2b5db5ceea542a55180c7eb07","first_seen":"2023-04-08T09:20:52Z","last_seen":"2026-08-11T17:29:35.484653Z","times_seen":1191,"resource_available":false,"data":null}},"time_used":417,"timings":{"blocked":256,"dns":0,"connect":0,"send":0,"wait":160,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2","fqdn":"c.s-microsoft.com","domain":"s-microsoft.com","tld":"com"},"ip":{"addr":"96.6.17.223","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoft.com","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft Azure RSA TLS Issuing CA 04","organization":"Microsoft Corporation"},"validity":{"start":"Mon, 21 Jul 2025 18:25:48 GMT","end":"Thu, 16 Jul 2026 18:25:48 GMT"},"fingerprint":{"sha1":"53:8C:3F:30:23:61:D8:6A:C5:D2:EB:98:33:02:6B:24:74:8A:06:8E","sha256":"93:A2:1C:36:17:A3:04:0F:E3:C9:48:67:9A:30:C2:2B:DC:BC:76:F6:4C:32:07:0E:10:E1:EF:D2:03:9F:CB:57"}}},"request":{"raw":"GET /static/fonts/segoe-ui/west-european/normal/latest.woff2 HTTP/1.1\r\nHost: c.s-microsoft.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://microsoft-teams.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 34052\r\ncontent-type: font/woff2\r\nlast-modified: Fri, 10 Jan 2020 19:09:43 GMT\r\naccept-ranges: bytes\r\netag: \"588d483e9c7d51:0\"\r\ncache-control: public, max-age=168443\r\nexpires: Sat, 29 Nov 2025 01:58:59 GMT\r\ndate: Thu, 27 Nov 2025 03:11:36 GMT\r\naccess-control-allow-methods: GET,POST\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34052,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34052, version 0.0","md5":"36397a3bc139c6e9f81d383f060f080a","sha1":"3f4f86c10920d4ed345f4858b6cde9f93e1aeb81","sha256":"4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b","sha512":"7fff4870e9142e6e1921f8dd78e3b049547ec1d540efe573c2938f8b855db61ba908fa9d3c8da1bb2aae6d95217a586d256b9ea2bd8a8f706b1db75bc21f2cb9","ssdeep":"768:WHH8jjaseVFXnmQ8njOkV5c4d7DOgx1J89JzHNBbFOlsy0kQ6lhe:kH8jj3uWxKe5c4xz69hNalP0kQ6lhe","tlshash":"9ae2e155279c3669bc505e7f05bc2586072ca2d6fa7be0e90bb9d05333ac69f24cde04","first_seen":"2023-04-18T11:30:37Z","last_seen":"2026-08-11T17:29:35.498478Z","times_seen":12672,"resource_available":false,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-product-pricing.ACSHASHde5a77dc6cdb73df9c309639792.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-product-pricing.ACSHASHde5a77dc6cdb73df9c309639792.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-110\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":272,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"de5a77dc6cdb73df9c3096397924a3f0","sha1":"4c8948d294f189077ae36628fee5ff6c8b3c5f79","sha256":"c691ab7286319bc87981a989f1726aae7da318cfe15c4f6f15b15ec13fe9e64b","sha512":"d1fe1a0555a7fbb42afbff9ca4a62174d0d690ab71c53b87b078e5fbda8c6b5530f33867c9d0dfe0c8d95f6cbb6d7bf85c6eb3d0c8f963479dfd1b0fc30c6020","ssdeep":"","tlshash":"b3d042cbf67d2acab013803049c97aa73c10252022a0093f8c25f9217e0e55236f348a","first_seen":"2023-05-09T23:33:16Z","last_seen":"2026-08-11T17:29:35.511779Z","times_seen":785,"resource_available":false,"data":null}},"time_used":1205,"timings":{"blocked":1051,"dns":0,"connect":0,"send":0,"wait":154,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:49:32 GMT\r\nConnection: keep-alive\r\nETag: \"68c3984c-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":536,"timings":{"blocked":63,"dns":0,"connect":0,"send":0,"wait":155,"receive":318,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/latest.woff2","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:36.119Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/latest.woff2 HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/index_files/main-teams.ACSHASHd93c5c7892edf2eb327dd4b5f4c539f0.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 826840\r\nLast-Modified: Fri, 12 Sep 2025 03:49:32 GMT\r\nConnection: keep-alive\r\nETag: \"68c3984c-c9dd8\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":826840,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 826840, version 1.0","md5":"a265e0037bef7a34aaceb90a79423468","sha1":"95186540289b0f6e8e86a2c602ecc8874e1b9e8c","sha256":"906d9df00b13497b5f75148da5c4bc98f05897a965dfdcdbd4931e05be780379","sha512":"d2bbd48e6f8e186a5aab22905241a54fb2f36842a9eb50c39dabe5bf69b0003086dd04188e6c4c17ee77833b9fb8c030dc132fed694a4a9aeccabdd23d7aec92","ssdeep":"24576:CyJVYXtGcubEXoGDptSbSQNmIqTekwjPQ6w:CyJDcGuPSbwtTqw","tlshash":"220523c2d436539006491bde0eb96d2ac6e827e5c82146ac6f3cd947566c289fec3bd3","first_seen":"2025-04-01T07:25:59.41873Z","last_seen":"2026-08-11T17:29:35.435861Z","times_seen":731,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":236,"dns":0,"connect":0,"send":0,"wait":151,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/main-light.ACSHASH5987fea4fceb192e7046aa914c7350e4.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.196Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/main-light.ACSHASH5987fea4fceb192e7046aa914c7350e4.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-8352d\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":537901,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (655)","md5":"8af0ec8d1bf286f330a640028e291644","sha1":"2d4869c0f5e49ba97b91d63793276b70c51452fd","sha256":"bb6ea61f58abc3c1445fc565e785ab12e2c344fe5e873446c6c5ecb09f556078","sha512":"5388b9f84ef1aa3086334a01aa681b9607c9bf44902b1a9041aa2a715546c396cdd3c6dcd90fa167df9ff3d3e8de78f13178cae2f99130255e2d43cd4315a4e0","ssdeep":"6144:o0Liw9tq3fe4Z2F8E79Cg+QSCOn+a9+Xx5xJakA1FXPTf9u:o0LgPIxCcakAzhu","tlshash":"dfb439d87262b57245ebe2baa16f1943b236688ca504847c7459ccdd3cf8c8d017bfb9","first_seen":"2025-09-15T17:19:13.461204Z","last_seen":"2026-04-15T17:41:59.469725Z","times_seen":19,"resource_available":true,"data":null}},"time_used":1192,"timings":{"blocked":428,"dns":0,"connect":0,"send":0,"wait":313,"receive":451,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-uhf.ACSHASHf9f2395c582fa601707b7a5dfae9f05f.min.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-uhf.ACSHASHf9f2395c582fa601707b7a5dfae9f05f.min.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-196\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":406,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"f9f2395c582fa601707b7a5dfae9f05f","sha1":"27b15aecd0bfdd3b25556ac00755856d4d331e0d","sha256":"d7d6d06624d4bdf6935b848df342ce322d02b58d12bf12149df92d557e5e9bc4","sha512":"f3378927d96b0b172981a821a8c2a16d0f397ed92e835b7c46316fc48350402d972a5411f0fa4c260f205aa1f7917f83f8247bf8a62c7f22e0076b168275b1e9","ssdeep":"","tlshash":"cae0a7bef173e8924b6f08f259023575aa6cc88b72611470e7d5a7490f4408351e34d5","first_seen":"2023-04-08T09:20:51Z","last_seen":"2026-08-11T17:29:35.468316Z","times_seen":4042,"resource_available":false,"data":null}},"time_used":605,"timings":{"blocked":455,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v1.ACSHASHa238861e6209e4e02576ddf5d1749c8b.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/v1.ACSHASHa238861e6209e4e02576ddf5d1749c8b.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-e3a\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3642,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (541)","md5":"be3f2a9f6a41fc40556efe260fc861a5","sha1":"ef6d673802edf44c01eea9dd86df4e5acd21757e","sha256":"c94f3b6aa377cfc8d9416f38aedf1e49c43de0bdc6726858720610827df2dd3e","sha512":"05ed779f490e9f21153e0c6838198a9e5337c4361644e62a5c99bca3978001840cac2e947874983fabf15573fdda548567176f77b0393a827e27e47ecb01792a","ssdeep":"","tlshash":"d471765a7bc5e030ab5d1433e26fda0a717136a3c84980a1f0598ca83a75b6572b2bf4","first_seen":"2024-08-06T07:44:39Z","last_seen":"2026-04-15T17:41:59.453517Z","times_seen":467,"resource_available":true,"data":null}},"time_used":1036,"timings":{"blocked":884,"dns":0,"connect":0,"send":0,"wait":151,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-sku-telemetry.ACSHASH05922ae5c69da5ad2aeae9f3b3a651.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.224Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-sku-telemetry.ACSHASH05922ae5c69da5ad2aeae9f3b3a651.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-249f\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9375,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"05922ae5c69da5ad2aeae9f3b3a651a1","sha1":"a977a5af19e280a09c4a069ce3578ca4c04467e1","sha256":"d7d858a30f0d153f23ae93b891aeb9a531b4dad5bad436fd493907ae6b1ada67","sha512":"d377e458f9519cb459f27a5e67ccf1cb6f6648d03d9472b0c9cfe7afcfbbaa6215b387833227db9147f426f44715de345ac2968e0ddaf51c3583de6fb566d8d6","ssdeep":"192:gOXv8KLobVkiKcSkP9pJkiKsNrqrSLxbPDH41FQXiucRWWK5lwepXb1qL:hvxceWFk4gwcWPRLQ","tlshash":"3a12659977f221f19a6b207de69b04c8f17851273909ca01fc0cd2185fa8be5d6f9bc9","first_seen":"2025-07-07T04:53:31.249906Z","last_seen":"2026-08-11T05:10:21.796475Z","times_seen":623,"resource_available":true,"data":null}},"time_used":1333,"timings":{"blocked":1182,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH81b1ef0c4a6b80454291234fcd6e.css","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.258Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-reimagine-base.ACSHASH81b1ef0c4a6b80454291234fcd6e.css HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: text/css\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-7b5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1973,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (510)","md5":"81b1ef0c4a6b80454291234fcd6e45b0","sha1":"1353f3119d378ffb222149ae19755423ef5347be","sha256":"b05d865a37d5efc60e028bc9fbc6b63459c78d21b0b70b3797ac97c1ad9ba88d","sha512":"6409931af06bae75e4cfc57ff2b877915404a9d805f8c9076390c4bc8ff634ba96b2ed561fcc4e57869110e62be05ab75a1578e7935cec9605eaa77c893643ad","ssdeep":"","tlshash":"a041424f86f38fa3302a01debf905918a9417583e2c549df58949c6e5a8f42d0b37d6b","first_seen":"2024-04-09T09:34:43Z","last_seen":"2026-08-11T17:29:35.434999Z","times_seen":807,"resource_available":false,"data":null}},"time_used":1456,"timings":{"blocked":1304,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/rum-standalone.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/rum-standalone.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-17f6\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6134,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"5e8251b321087f7638883fb4d5793722","sha1":"1e54932bfa11be05349c57b74370cc4d2fb43983","sha256":"7405ac8135bc57a96fb585cb03c7c950476620ca0db911d7f4e3848f6f499c20","sha512":"c1fda021959b10d95e49d40913ea356ba58b244efe2ac589a3080798da9fddd003c22cf6cecd8cbf318df95f38add88cbfc7f786775b47089d1a26451b83d33e","ssdeep":"96:9J4o/vHtcZlHR9FGSA8a32BtT3lh21LZU6KJyaz8qJWDuB:T1vHslHRmSA8y2B93lh21LZV+yazFJz","tlshash":"68c194590da2413141b3516f1b5bfb677263a11772c6e1863dacc3003f1aa5bfab1bd8","first_seen":"2025-05-23T15:02:37.102812Z","last_seen":"2026-08-11T10:28:42.227822Z","times_seen":3331,"resource_available":true,"data":null}},"time_used":747,"timings":{"blocked":285,"dns":0,"connect":148,"send":0,"wait":150,"receive":1,"ssl":159},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/featurecontrol.ACSHASHf120033122e43a4cb0b53bb306afc5dc.min.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/featurecontrol.ACSHASHf120033122e43a4cb0b53bb306afc5dc.min.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-9f\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with no line terminators","md5":"c22ea5b46f3fcad90da0abcc0a3f73d4","sha1":"2db789c63afb63d98932d7b55907dc3508e318b4","sha256":"8334daa260516bb896407461e5f10e8e3041b06c56846bbb9d3435c6e77513ad","sha512":"a0359f8c25dc40ceffd14a41ba81794717b99dabe78cbf8a8678f3e3ec57f317388ca0dc55b1cc6ad2d6c13d2b3caeb5a64527bb2c646ed2d93775437da646f1","ssdeep":"","tlshash":"25c0803f756875343dcb0df5501d4ad56c1e5dd401055131195cd85464d8add4136a15","first_seen":"2023-05-03T04:39:02Z","last_seen":"2026-04-15T17:41:59.540908Z","times_seen":842,"resource_available":true,"data":null}},"time_used":1604,"timings":{"blocked":1452,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2","fqdn":"c.s-microsoft.com","domain":"s-microsoft.com","tld":"com"},"ip":{"addr":"96.6.17.223","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoft.com","organization":"Microsoft Corporation"},"issuer":{"commonName":"Microsoft Azure RSA TLS Issuing CA 04","organization":"Microsoft Corporation"},"validity":{"start":"Mon, 21 Jul 2025 18:25:48 GMT","end":"Thu, 16 Jul 2026 18:25:48 GMT"},"fingerprint":{"sha1":"53:8C:3F:30:23:61:D8:6A:C5:D2:EB:98:33:02:6B:24:74:8A:06:8E","sha256":"93:A2:1C:36:17:A3:04:0F:E3:C9:48:67:9A:30:C2:2B:DC:BC:76:F6:4C:32:07:0E:10:E1:EF:D2:03:9F:CB:57"}}},"request":{"raw":"GET /static/fonts/segoe-ui/west-european/Semibold/latest.woff2 HTTP/1.1\r\nHost: c.s-microsoft.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://microsoft-teams.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-length: 29388\r\ncontent-type: font/woff2\r\nlast-modified: Fri, 10 Jan 2020 19:09:43 GMT\r\naccept-ranges: bytes\r\netag: \"5b68d583e9c7d51:0\"\r\ncache-control: public, max-age=108129\r\nexpires: Fri, 28 Nov 2025 09:13:44 GMT\r\ndate: Thu, 27 Nov 2025 03:11:35 GMT\r\naccess-control-allow-methods: GET,POST\r\naccess-control-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":29388,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 29388, version 0.0","md5":"6e75a94d5f7170a1ab532d32c2a35755","sha1":"9c1b6fff544089941bbeddbcf529c3f0b46d853a","sha256":"d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f","sha512":"27cdbf98a3f42510eaeb28437e3c4661734b685d63eff5e47364ac46b73de617894edcb19ddd9afd955de192cfd8bb755998ed609ec2c279e9afab3db2583175","ssdeep":"768:2075f+Dti4JBZRdp49Z5wmWPb2O7a35bAvDWIfe:2k5fOtiCXvb2OG3I1e","tlshash":"f0d2e1ceb288a6b2cf6f2234d60344d63a3be647565d38b4adc49d918b20d0fe4dd04b","first_seen":"2023-04-18T11:30:37Z","last_seen":"2026-08-11T17:29:35.447354Z","times_seen":11966,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":61,"dns":0,"connect":0,"send":0,"wait":3,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-onecloud-util.ACSHASHe27d1f017cb64db7f5a2a53fe34faf.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.194Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-onecloud-util.ACSHASHe27d1f017cb64db7f5a2a53fe34faf.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:34 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-1463\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5219,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"e27d1f017cb64db7f5a2a53fe34faf64","sha1":"795eab7cd51acee60158f8938c5ee63b47e2efa2","sha256":"edce1c270b17547cb4353cb02df79ab58147a7566fe4ccf6e5df4423adde80bf","sha512":"c9984eb59da79661602aee8868526869dbe8f8b3e1ce83ab2cda43226f3d13f0d540fcd24722cabf32ce90aef15e40cb5d28bf2f2a194fe4a0d4deca800e9b96","ssdeep":"96:2VZw3gPuCrA3bm7+qWtNmOy47ZhiqdZCOkhZvRT0xZtCE13FMksINza0IMqiEd:2VZ4gPuCQbQ+qWtMOL1hiDOkhZotCE1K","tlshash":"e5b1b4863af12062177b604e838ba0c0b735e16f3a59189579ce5a141f9cf3c96f67c4","first_seen":"2025-07-24T21:09:08.971375Z","last_seen":"2026-08-11T17:29:35.426883Z","times_seen":899,"resource_available":true,"data":null}},"time_used":782,"timings":{"blocked":297,"dns":1,"connect":163,"send":0,"wait":157,"receive":0,"ssl":161},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/msochead.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/msochead.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-18400\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":99328,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (11895)","md5":"a887ff5f5da3d49e01f4a6ee1b3f8a06","sha1":"7f2da8bb0b1b1869ba4eebadb6233e66e17f2870","sha256":"3fd50107e2211b067c9c0d73e822a5639087504e4b7491e176a0ba7eda9ee22d","sha512":"c5691ed783d3a2ada73d78eabae766a6401eafb3d35ccef4681096819d6ecfe8699087170162b389cd6904f800ff6a5e1ff3d5d1fedea4965011502059846f1e","ssdeep":"1536:ECkYe2qD3D1Ug5xeKx7j92Vf6zqh5kCThY6g3Eh6ZphYFN7Qfb0a3rBSd/v:fY5wKzwqMindYFM3rBKn","tlshash":"aca35c79b19810734bb315cbf1a23244b92d13e77400e4e6b55ec9583bdbacb5063aaf","first_seen":"2025-09-12T00:00:49.088544Z","last_seen":"2026-04-15T17:41:59.507661Z","times_seen":20,"resource_available":true,"data":null}},"time_used":1044,"timings":{"blocked":885,"dns":0,"connect":0,"send":0,"wait":158,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/v4.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/v4.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-11891\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71825,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5fd91ee5ca6194ecda563b58efc45a31","sha1":"526fe129cbcf4816dda728c21d62c521921a0dea","sha256":"7f524501e24731095c4a4e0099fac5b14806eddac9db74f075166645c1be6ed7","sha512":"56d8e72e6f1af6e713c92705ca3c4fe045650c4012eddd840a95b6075dcd13eba8bbba4bf646f4d93954493065e9a93105b1be54e1907ac6f67c798f031c3688","ssdeep":"1536:IMYT4Pkz0hiK7EgmrawceNnYVVsKzmQVZywlJOPtpDiYKtJhcvfDv:IMYNg2phYVVsKz7VKVKuf7","tlshash":"de63e7e97681703543a364b6203f610bb33b6a69690f8154f114e4e63dbde9e8237f6c","first_seen":"2025-09-11T17:20:06.578287Z","last_seen":"2026-04-15T17:41:59.47221Z","times_seen":400,"resource_available":true,"data":null}},"time_used":1054,"timings":{"blocked":900,"dns":0,"connect":0,"send":0,"wait":153,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-reimagine-base.ACSHASH92086374c4d8b656871df44219c5b.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-reimagine-base.ACSHASH92086374c4d8b656871df44219c5b.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-2679\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9849,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"08c5f9cb4220e78ff920dae3a7a8ed53","sha1":"06063cc0de00b0f698b07deb66ddede5c60940e7","sha256":"e8b12100e50470ae78ca039d5662394a89e01c61fe8d4682dfe606e906e677ed","sha512":"0e7ed8c068fa14123041314f58c1473df3eb60c3b6ce1a95b1a7066c1b151d5d7ec6f2d585b2862721db164b9ce79e61dfb6fb0a53951504bb2235739b4c35f6","ssdeep":"192:0OQGrOUjDYq5FEF/zj2wrEEegbSYCkK2MlXW2UqEcK9MwC1uAyI9J3Yullgubepd:DrzjDYq5FEFLjRJpKJxWrqhKGXy83Y39","tlshash":"2f12311d27f65132493f747d1f2b664e7352431bf0488a083c8f42a50fa1ea6d9f2a99","first_seen":"2024-03-18T17:19:55Z","last_seen":"2026-04-15T17:41:59.513445Z","times_seen":244,"resource_available":true,"data":null}},"time_used":1464,"timings":{"blocked":1314,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-cookieconsent.ACSHASHc892f451b0c4db9c8ab2601a427c9b.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-cookieconsent.ACSHASHc892f451b0c4db9c8ab2601a427c9b.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-af\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":175,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with no line terminators","md5":"96f0c5b1219e39b8788028f5c17a5ad9","sha1":"d6dce0de065b0d13905eaeda0ba5c0dea3d8f67c","sha256":"1fc2bce2d46df4565b8c488b22225cfe7adb7c37cc9a542d4f85b61995b306cb","sha512":"057810fa0558506c6b8abecb1a7a58ff61da0609b3a5798bb42de3a9b801ca0d8b20c4c1f9a250ee33d30492452cc5c4553332b16300408aa0c45b1515d4af10","ssdeep":"","tlshash":"93c012272681430853e70271510a4605f20062f9d79c013a1a5015a005a0e1936fc9da","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.511683Z","times_seen":842,"resource_available":true,"data":null}},"time_used":1600,"timings":{"blocked":1450,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-hero-bg-1600x580.avif","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.768Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-hero-bg-1600x580.avif HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/avif\r\nContent-Length: 496905\r\nConnection: keep-alive\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nETag: \"79509-63e9c92bdda80\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":496905,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"3262a0d614bea9f1e54211df6109d20b","sha1":"23b347a81a56d08047ca232a8a8b75a58e6d55d0","sha256":"100cef0ad66d2d91ed55872225ce6979bd5da4f593d5ee9b4d9aa711992a3b9d","sha512":"5c57fe851018447bc2404bd20be643c7e00ab4a167ca3b05e00a27363b97e4f158a83a28375030b6bee3d32a7eb9565a976f2e85556a4d3e8bfbb1fb3239f855","ssdeep":"12288:NfTauT3JcuZoEvDIwdIEWd+sSOINmfkh+0suICfiizEFcyvGEtO:xTagLPcIsOObfAHfnzEF4Ec","tlshash":"eab42396982a4664ab2cc0798fa256bc8cd3e58432cc07fbb9c35f6dc9c5841f609f57","first_seen":"2024-12-12T19:57:47.866675Z","last_seen":"2026-08-07T01:12:06.958036Z","times_seen":38,"resource_available":false,"data":null}},"time_used":920,"timings":{"blocked":281,"dns":0,"connect":0,"send":0,"wait":165,"receive":474,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/340650-cta-banner-1600x568.avif","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:35.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/340650-cta-banner-1600x568.avif HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:36 GMT\r\nContent-Type: image/avif\r\nContent-Length: 562\r\nConnection: keep-alive\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nETag: \"232-63e9c92bdda80\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":562,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"cf7f5bafeba11f0f77b56192843594db","sha1":"010227bda9990bb65d2602dcf646b811f1aabe78","sha256":"7851cf53d4710e1bd0ddc86fd6c4877e8c324fb2f16bed7d2061d9c06e2d7e9a","sha512":"cdc5633263769e4fea5f10573084fb08fdfb0206e8dc4900c2f7be0df99f4e7b921c5544c2fb5bfb6c5c58cef10dfb4403008e1465dbc6d35d63c3f9996a621c","ssdeep":"","tlshash":"d7f0205c33622c06d81d457608240b133733f05009ac351aa147b7284c306f8ee20f59","first_seen":"2024-12-12T19:57:47.88144Z","last_seen":"2026-08-07T01:12:06.943266Z","times_seen":38,"resource_available":false,"data":null}},"time_used":912,"timings":{"blocked":754,"dns":0,"connect":0,"send":0,"wait":158,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoft-teams.icu/index_files/clientlib-jquery-cookie.ACSHASH5c75a4fa9fb3503322f8a0c9dd5151.js","fqdn":"microsoft-teams.icu","domain":"microsoft-teams.icu","tld":"icu"},"ip":{"addr":"64.52.80.154","port":443,"asn":399629,"as":"BLNWX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://microsoft-teams.icu/","date":"2025-11-27T03:11:34.208Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"microsoft-teams.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 26 Nov 2025 14:01:46 GMT","end":"Tue, 24 Feb 2026 14:01:45 GMT"},"fingerprint":{"sha1":"DE:E2:32:48:4E:A4:76:0B:4C:0F:FF:1C:94:FE:96:3A:7F:84:E8:8A","sha256":"9C:71:B7:CE:5D:F1:4D:74:90:33:E5:7F:14:4C:D7:51:57:9E:3E:C9:9E:E2:3B:67:6F:1D:25:D9:1E:8D:D2:4B"}}},"request":{"raw":"GET /index_files/clientlib-jquery-cookie.ACSHASH5c75a4fa9fb3503322f8a0c9dd5151.js HTTP/1.1\r\nHost: microsoft-teams.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://microsoft-teams.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.0\r\nDate: Thu, 27 Nov 2025 03:11:35 GMT\r\nContent-Type: application/javascript; charset=utf-8\r\nLast-Modified: Fri, 12 Sep 2025 15:47:38 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"68c4409a-58a\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1418,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (505)","md5":"20aafdf6904d3dc5db0e0e33abbfc1a4","sha1":"cc1a639ff69fe0d8a8f1efee7fcb04941e7b57c8","sha256":"ee4e620f350907ce3867454b2bd45984be949eb46b113183d4b8b403032da14d","sha512":"91b0bd81fcd2d3d040d9fc1db74f5ca916ef88e7887d2868530bf1319eaf5462cc54421ab80fc97b258b569b9af40f2b9fd1b6d417c9a4561bba22edf785d905","ssdeep":"","tlshash":"7d2196d8708bb8474e665b26723f042e70bcde0194cc8848c702d9e07e30e032a71bf9","first_seen":"2023-05-03T04:39:03Z","last_seen":"2026-04-15T17:41:59.47981Z","times_seen":842,"resource_available":true,"data":null}},"time_used":889,"timings":{"blocked":737,"dns":0,"connect":0,"send":0,"wait":152,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-27","alert":"Sinkholed","trigger":"microsoft-teams.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}