{"report_id":"da15bdb2-2faf-44af-a0bb-2ba7da9863a9","version":0,"status":"done","tags":[],"date":"2026-07-18T17:21:45Z","url":{"schema":"http","addr":"microsoftoffice.tech","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"ip":{"addr":"149.28.76.12","port":0,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"microsoftoffice.tech/","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"title":"Microsoft Support","dom":{"size":17977,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (477)","md5":"7ddbdeb53160b46672faf668e04ded88","sha1":"3df987d1e5a78e052a5fe06f2fc883f4498e02fc","sha256":"12f97e86be7211f97889f0e1173d8d90db516f7f8bf2aba626aa290a7b7d7e76","sha512":"472ce57f8cbe25b4b2fb5dae88bdc52e4769035c98fb35e218e3a8beaf959d13661ca600c8d16ecfc5f3a2e89a2e4092a8befde88cdf4a04c23ab05ee2124c4a","ssdeep":"192:dqaP6HdITgOoG/mQx4RxQDOLJKYiUV2E7WaAL5KMueAZ5JnYuT9iLmi1MFIvS70k:dNF2viXyDAVkptrf","tlshash":"c882b76a52f31129b82384a52feb274b2355c013d10eca297bed635c8f854caedb334c","dom_hash":"domhash5a72bc6b2fde9e875e8261b6c42c6995","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"microsoftoffice.tech","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"ip":{"addr":"149.28.76.12","port":0,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T17:21:45Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"microsoftoffice.tech","ip":{"addr":"149.28.76.12","port":443,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"domain_registered":"2026-07-16","domain_rank":0,"first_seen":"2026-07-18T17:21:45.540161Z","last_seen":"2026-07-18T17:21:45.540161Z","alert_count":4,"request_count":2,"received_data":18707,"sent_data":1005,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"microsoftoffice.tech/","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"ip":{"addr":"149.28.76.12","port":443,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"73050e48a3643c67df9c0367dcd9b1b8","sha1":"07cdadefa50379119f478744d5f592ca0a60cde6","sha256":"2e98f7eed57ed8fab8873168f5e5b3ab14254ac1b70e021c9763c661b0d25e13","sha512":"2e16ff64c4eda17caa03a858f85f477c8b038b5ddad5662e43772d520f61d3a797b8fb46cfbe46d2ccfa805e8338c5c0e5965c8a342195c897f0d990c27bc050","ssdeep":"","tlshash":"6541643f3903c6aa69a7d02784df52256daa10570c08e740b46dc04e7fac65ccafb1da","size":1886,"data":"","first_seen":"2026-07-18T17:21:48.001971Z","last_seen":"2026-07-18T17:25:53.566598Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"microsoftoffice.tech/","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"ip":{"addr":"149.28.76.12","port":443,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T17:21:17.172Z","timestamp":1784395277172,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoftoffice.tech","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 18:18:55 GMT","end":"Wed, 14 Oct 2026 18:18:54 GMT"},"fingerprint":{"sha1":"F9:32:7C:AD:3B:8B:AF:91:59:3B:CE:D0:CA:23:A8:94:BC:3B:DA:0F","sha256":"D3:95:CB:3A:48:07:87:0D:CC:2F:50:1E:68:E7:48:CF:A1:D5:E9:CF:9F:A0:31:75:2B:7C:29:72:16:68:FE:27"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: microsoftoffice.tech\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:21:18 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 16 Jul 2026 19:31:00 GMT\r\netag: W/\"45de-656bf7ae76acd\"\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17886,"size_decoded":4940,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (465)","md5":"cfb7adaa2ec297a8130ba00c2ba7fdde","sha1":"5f8c15c03c9afabcfbba9a9ed18c814cae79c354","sha256":"5b317693ac0b418b8a6021d84db20eb5bb548685f5e36f925522f054ebc57052","sha512":"b18f19c2e0f86e19448dfb8a0ac2c1d163d98f08231d668ef6d4ac2c793496cdd80e4fb2d0417146d7aa38aff08031f6a07af03c7ad1e6bb254376c89243d7a1","ssdeep":"192:DqaP6HdITgOoG/mQx4RxQDOLJKYiUV2E7WaAL5KMueAZ5JnYuT9OLmi1pFIFSZf/:DNF2vOXZFJukptrD","tlshash":"e682b76a52f31169b82384a52feb274b3355c013d10aca297bed635c9f854caedb335c","first_seen":"2026-07-18T17:21:48.000099Z","last_seen":"2026-07-18T17:25:53.565033Z","times_seen":2,"resource_available":true,"data":null}},"time_used":993,"timings":{"blocked":-1,"dns":332,"connect":160,"send":0,"wait":175,"receive":0,"ssl":325},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"microsoftoffice.tech/favicon.ico","fqdn":"microsoftoffice.tech","domain":"microsoftoffice.tech","tld":"tech"},"ip":{"addr":"149.28.76.12","port":443,"asn":20473,"as":"AS-VULTR","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://microsoftoffice.tech/","date":"2026-07-18T17:21:18.424Z","timestamp":1784395278424,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.microsoftoffice.tech","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 18:18:55 GMT","end":"Wed, 14 Oct 2026 18:18:54 GMT"},"fingerprint":{"sha1":"F9:32:7C:AD:3B:8B:AF:91:59:3B:CE:D0:CA:23:A8:94:BC:3B:DA:0F","sha256":"D3:95:CB:3A:48:07:87:0D:CC:2F:50:1E:68:E7:48:CF:A1:D5:E9:CF:9F:A0:31:75:2B:7C:29:72:16:68:FE:27"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: microsoftoffice.tech\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://microsoftoffice.tech/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Sat, 18 Jul 2026 17:21:18 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\nvary: Accept-Encoding\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":411,"size_decoded":404,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a39fe1a1d8d11b1cc8022b6815f037ad","sha1":"6a06a81a2223e4336d5dce6d71e93ece52a7b226","sha256":"ce45f8fb6be1ba6f7c7d836e917a3f24ac356dfb5f2c4baf6f480681ed0876b0","sha512":"53f8fdb0fc20a5951a9946897bb7c315518ce7a6a9568264dc7f0235f488654a584055112e62ca68b09d5decd8f9098199da291a2747a30bce7372142f5bae76","ssdeep":"","tlshash":"65e0f10fc0960347b10569957ec223d2710d4387a4b687f438825484ce4e1bd80e87cc","first_seen":"2026-03-07T00:50:45.21392Z","last_seen":"2026-07-18T17:25:53.565922Z","times_seen":3116,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"microsoftoffice.tech","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}