{"report_id":"e9ad0cba-aa72-4d53-8682-c1e01de282c0","version":0,"status":"done","tags":[],"date":"2026-09-22T20:40:06Z","url":{"schema":"http","addr":"sb-invoices-old.castineapps.com/auth/login/local","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/auth/login/local","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"title":"Scotiabank","dom":{"size":10729,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (848)","md5":"42cff201fbe3df579bee5bd4b1614415","sha1":"922de9e57dfe3c7af87e203f35254f9dcaf61f86","sha256":"eba90836cc7b47b2dc3e2da49cb4c35c2714131700197f1fed432fb08ec1785a","sha512":"20474c92461df42836278e888bd6b77a36b08d8d724144c3454f8bcf53b1922b71497ef47cab1cc6d60f32e8b6b8f4dcc167e37f8f2927ead04488732f085981","ssdeep":"192:jCBSC8wGILBJPxgF0RJ8WzAiiLtCBMm5Z3++9bfLSE19MqOq4qaeAKj7x534O2jk:e/xgF4RBMS+I7LSE19MjbNeAKj7v39+k","tlshash":"012292219cb44823116369d8b276af09aa85c61bc707ce1833fd97e91fc2d96cd13728","dom_hash":"domhashee6ac1926e6cbe447e1947117fe73991","first_seen":"2026-09-22T20:40:23.934079Z","last_seen":"2026-09-22T20:40:23.934079Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"sb-invoices-old.castineapps.com/auth/login/local","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-27T20:40:06Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-20T22:43:34.841753Z","alert_count":0,"request_count":1,"received_data":1458,"sent_data":511,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-20T22:43:37.149177Z","alert_count":0,"request_count":1,"received_data":24393,"sent_data":563,"comment":"","tags":null,"fingerprints":null},{"fqdn":"sb-invoices-old.castineapps.com","ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2018-04-18","domain_rank":0,"first_seen":"2026-09-22T01:02:46.619993Z","last_seen":"2026-09-22T01:02:46.619993Z","alert_count":130,"request_count":26,"received_data":889455,"sent_data":19456,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Sentry:5.15.5","description":"Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.","website":"https://sentry.io/","common_platform_enumeration":"","icon":"Sentry.svg","categories":["Issue trackers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Bootbox.js","description":"Bootbox.js is a small JavaScript library which allows you to create custom modal dialogs using Bootstrap modals, without having to worry about creating, managing, or removing any of the required DOM elements or JavaScript event handlers.","website":"https://bootboxjs.com/","common_platform_enumeration":"","icon":"Bootbox.js.png","categories":["JavaScript libraries"]},{"name":"SweetAlert","description":"SweetAlert is a JavaScript library that provides alternative alert and modal dialog boxes for web applications, with customisable features, aiming to improve the user interface of the default browser dialogs.","website":"https://sweetalert.js.org","common_platform_enumeration":"","icon":"SweetAlert.png","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/js/fns.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c0ab0e1a1d0d65c91d59d55b46ce11d0","sha1":"8cc5799ba94556d7f94b5c66c95af69ea63fcbfd","sha256":"d3cea083d5fdee814d28521ff1b808a48bc76e9032421d398e47e029a25712ff","sha512":"967ff063b50fe9659ffa0a9d1f6d9c691ef8b7385eb5638989d24f0b06bbfd35e1ddf0d557e8d9baa82cc567e6e0be3f0d4ee2e12258c7e15c4c4c85e33146be","ssdeep":"","tlshash":"fe515648b4f669f4852270784b5f7400f279dd93116cd974be9c9ea41fa442883fdbe8","size":2745,"data":"","first_seen":"2025-07-02T21:54:35.494792Z","last_seen":"2026-09-22T20:40:23.959176Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/dist/sweetalert.min.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0068f44b0aa1b83fa7679860ceb26590","sha1":"20d5cdb9d2002442843baab241f2e883563d1de5","sha256":"7a056fc64aba501090c8acd106b0c7bbc9a267914e695ae34aa42a6ae2a094a7","sha512":"ed54e2cbd021a5acc178a40096168b45493e9003006fca1cce58eec891cfb153d6a31fd02170c53a74fd0d4935502f046e71ca45d428c13eec3817bb2c08da8d","ssdeep":"384:Rixwo5U75rT3rOlgkhzj7qRM0I2XyySyTXmy9ti/IEUVRj6KaVnzZduTQRc8exfx:RiU3rfRMbwd9t2UVR2KaVz/uMRc8exp","tlshash":"5772b84d315438b313a765f150af8147a4b15abde80998a0366cc4e61ff8c8e6ae2f77","size":16977,"data":"","first_seen":"2023-03-07T01:15:37Z","last_seen":"2026-09-22T20:40:23.964936Z","times_seen":4262,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/js/swal.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c3f472ee03c2d6165606331765df930a","sha1":"44824d7f6f8d69de2d704e4e6a72d1c8faf7ed00","sha256":"faf160af0163aa80b6e93da8edd8c12bb70a07dc0b1c4d11119631e93c990136","sha512":"780f029324297a035099f0718bba7c8424afc93d912a120cd7dddbe4190bfb4c9ca61b0dfa7ede57729d5a37c0792be41877c1b0968131b7e60bba58e10ec3d0","ssdeep":"","tlshash":"79019ed1f9bf273a0c3aa27214cf3315452064a35d0928f5b888a7d46f4d17897d3f48","size":667,"data":"","first_seen":"2025-07-02T21:54:35.484519Z","last_seen":"2026-09-22T20:40:23.947014Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/3bad3e813ea594e56c867256b5e49079/jquery.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"12e87d2f3a4c8b347ab13a0764d420a3","sha1":"4be715e11048c057fdf2ee0fbbfad4dbf3504c55","sha256":"78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe","sha512":"fa4d699e582de05d47f0beeddf3f79a37fca3bea3bf083447174db9e8250fc5d95a835615a86a256697f3841eff47b1583151a556f886e264f50941f17f63167","ssdeep":"6144:gwsmYhct1SS+TC1lmhTzeKRYcYmD2zK8USJsdZQ/coLGVFyy/RgL/uiOgeNTIPfz:FuYcYmD4/cZQ/coLGVFyCJTiPf7AqqAV","tlshash":"e954a3d8f78d112e423231aaad2e12cdbb7dd171561454aefd4d497c24a083c83baf7a","size":285314,"data":"","first_seen":"2023-09-15T16:51:13Z","last_seen":"2026-09-22T20:44:13.252885Z","times_seen":18398,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/1c90e423150d143076f8f39f73d87de6/bms.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e3fcd6ed9d84ecff013d5a518285572b","sha1":"3bb30e318ac3073662820426e3b51cde90d4e9b8","sha256":"8bb2f91c5e0ad8fbe4d229dbb919423955a1eafbe2214ec282359d9d431e5ffe","sha512":"5ea8942743bb851517e19756ed9e9faa461e156e0a19ec859e153cc5621d98017f0dc83c3881818c39f6241ba22834e8f5e99e8f6a2c156a673b1ebe4a149ef5","ssdeep":"","tlshash":"2b511448b89df06b02fb60a5117b3f0b71549d67c70e090093b191adaebad59f832f49","size":2486,"data":"","first_seen":"2025-07-02T21:54:35.499454Z","last_seen":"2026-09-22T20:40:23.954641Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/dd2c02fcc07ca8f27d1be616b9e708e8/js/bootstrap.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"894d79839facf38d9fd672bdbe57443d","sha1":"11277f4e04cf070a350e566b053ef2215993720c","sha256":"dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2","sha512":"34fffaf69de2045e8b90adaf72c6c3d73b99bb581832ee7de1be78d34753a3ba97d3aa1b8527ec1747d25e27594e4e0a4a9104e1e7ede811ab748aa1b766842c","ssdeep":"768:K/Lx8D6XlsB92TiwZi7vu6EBI7v8vaSx4ElvhLxs7St8PsBdZsWSdA:wVGihuv8ySx4EosbyWQA","tlshash":"af7340167af921614b5b30ba8cdf614c7238901b550bd42878ad93d46f50b38a2bbffd","size":75484,"data":"","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-09-22T20:40:23.937292Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/d7d0d25991fdc879d353c149eb937755/jsencrypt.min.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"64507221feddff84c80b99c98827d76c","sha1":"5c7000638c6bae1a1c448367822a8682d59d371f","sha256":"5a0be406a1bdf94a25a9d142d4124e3dccbdeb5593cd78fb0bd234df89dd7389","sha512":"cc3beba9e9c0d1e149642c41b2bcb351972f8a1bcd9445dbb5e32feb6c91c5d851e2cecad5a6b3f8b8ec4727e4e8cf9824bc80244baeaae20023c23c1a02c2f0","ssdeep":"1536:cJxLSEwwmr2yZPp8yQPj6OR1fdfqovoRonm7f6T:cPErPp8yQPOOR1fdfqg2l7f6T","tlshash":"cb43e9853ae6b075039a50f0051f084ab13ab92e192f44ecf699d8e17cb584d637ffb9","size":56142,"data":"","first_seen":"2023-03-07T13:16:24Z","last_seen":"2026-09-22T20:40:23.957248Z","times_seen":21647,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/260a82b4a0d9832c0e6a0e96eb27b588/yii.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"45b4d3c3e9f50d5c63231e72b016e8cb","sha1":"dbbd08db02a4443bb46560aace36a0d4177af14c","sha256":"995516724f69e24ddf82e9279a65d50a6f64a2c325226f7133bda794d6bf79a5","sha512":"b803690a7284b5fe36541353b86bc081c5f93915eb09d5b98e830e6c92150a1b85e814b4e9bb4d5ae80c92e137188243f20accc2687f567c19f28f8b6ae0b874","ssdeep":"384:Oj0RfTossjpOkUeUnMkx8QfiZ9/lvitSlu11pNAd5:c0RfTosxkURMk2QfMpi0luzpOd5","tlshash":"0892a3197de330a32077747e9b9f4098a675901b212ace503c4c97b84f54eb986f2fe9","size":20953,"data":"","first_seen":"2023-03-07T12:10:45Z","last_seen":"2026-09-22T20:40:23.966991Z","times_seen":1882,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/7868a0c0682d315640732b3f66b428fe/bootbox.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"832ccef3a524e3aab9a927025f123e0d","sha1":"da2b7f5d7c628d9a593bf2fd39e535a5cd396e37","sha256":"d49a7723c795b85f0eeb2837252a2222f5acf8d7cee50a430139c60301dfb87f","sha512":"0231433942a90ff3ecdbaecffad735d38d0f429c6bf99bddf4733a71e1a4f21b13083faecbebdc034af24c07ceea05a7a7a990af80300abdfde16008983dfaad","ssdeep":"192:S3DonwtyclQglxZTog1Oa3PXAJCWxf/ryjC37BSVD+smarw3pfsmllrxHJGbHcZ8:SzowZqg1LwuI6wRwbH2OcJv3+","tlshash":"1d625f48a8fb23620ab371b9179f6658f639c523150cfe10395d03e11fa542a96ff7ca","size":15219,"data":"","first_seen":"2025-07-02T21:54:35.483181Z","last_seen":"2026-09-22T20:40:23.93818Z","times_seen":25,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/b56acc504e261818570e2af4ab2ff088/html_checkbox.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"73f32980a460b09c196e825336107588","sha1":"bb27d4a68fc8134d5bb8612ac79fda6738338b11","sha256":"f70f424bc6442b58fb0f9131640de53977e657128fd5846f6b5f322aeb828384","sha512":"671ee469e581c6531d290f36e43529f0e43892bc66f4ce66b742fe4d5bbc8267f0b0d7b020a2abe54a554d88061af0ab8154d2e59e720b3d43afc11a8055d0f1","ssdeep":"","tlshash":"5901b8993942f162bbaeb59441dae4036221785ed1270840e2a20e8bbb24e3c7173909","size":779,"data":"","first_seen":"2025-07-02T21:54:35.493815Z","last_seen":"2026-09-22T20:40:23.952518Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/utilities.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"12be02c1f866e3c36af4f344fad5e96e","sha1":"da27fe92d58d2763325988ec457cc0e7c2ace6d8","sha256":"96886deb334392eea487c3fb73b28d8e36583e7a9351dbf5e1bedd819300a027","sha512":"e7a6b84ed15fa75ae1cfde90e6e8324cc54f36439108363b734b70429fdf6557fb73f7f6c711c8e3c876beefc7cdcd8050bdbed4d489acb0b1f464542d3050ec","ssdeep":"96:V42gv9N6eAosKon0eiHYSX+YuYjPLIiaZ9Cf6IfID:VvgpRsKo0eZSX+YuYjPLIinfa","tlshash":"a491635d38a9b0a923fbb0a3116f1e0a7166be3bc0154540d0a385fd2d7de49e4a3f26","size":4233,"data":"","first_seen":"2025-07-02T21:54:35.504394Z","last_seen":"2026-09-22T20:40:23.963722Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/extend.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2a6e0af62c7f7c9c84d0b2fdab807aed","sha1":"288bcbb51741500d83a5dde6da0889612a4e5094","sha256":"7f5c1794e78826553b1d32a98b97fc8a275fc62e327d2818ccfab85912249d15","sha512":"5f74692f01bf093afa721402b456274e577eb9d0396bc2d1b1c100cd558c6a1b9c4874d29a32252e78be53852dba2ee58d723afd5c8da76c40a4ccfd058a4783","ssdeep":"","tlshash":"b0119e08fde23875652272a48b5fa41465befd571368cca17a4c62ea1f6103486fcee8","size":952,"data":"","first_seen":"2025-07-02T21:54:35.506108Z","last_seen":"2026-09-22T20:40:23.957947Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/jquery-overrides.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8d3fadf8c5aee04e8830cde5360c4f36","sha1":"005874a88fa82ade27e14a02c95914085d2534b4","sha256":"4007aa7cd65a5c4d764634dc905896b59eb19af32f32dcfbdae0ff76dc6c3ba4","sha512":"ed9109c0532b0855d4a9198922997894dba4cdf399112b59455c657f96dd4233bbc122cacb59ced72f174f38021eb657ec7e8254f7bdd4c0cf829afdd94408ed","ssdeep":"","tlshash":"4421af4428fc41a65cbf2077a5f14f9267994877100a56a5b18e6bb05fd4f2e27ef320","size":1114,"data":"","first_seen":"2025-07-02T21:54:35.507725Z","last_seen":"2026-09-22T20:40:23.939741Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/js/App.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4c33747474d7932a398dce46de96a017","sha1":"a0db930a6ff42da6c938befe7b8dd5068568ae89","sha256":"73836032bf79103e7f6eed38392eebed6f2d37b789dd88c7a9e4b65d2b0d4b02","sha512":"6e1996c9ca19acdfbf4dc036f8bfb698fc23baf846c6390b78a5db37fe014d9c887d69902aef75df9b0661f1bce42a5eed6663a068ee8aa6075ad7b66787af63","ssdeep":"","tlshash":"1d71c305eae2206061ffd0ed4ebf5300696650db6285cc8df9bc1ad0dfb8939d2d69d8","size":3533,"data":"","first_seen":"2025-07-02T21:54:35.50527Z","last_seen":"2026-09-22T20:40:23.941219Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/auth/login/local","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"7eb602a58d545d0f667292274c606d06","sha1":"932714ec640137eb16491bac3ff09adfe8ebccba","sha256":"cd4b6c30843eac807effadb56faeb33e325e9b649fd2b21ba1fa519d4a23330b","sha512":"96a1a7327c43dd7994ecc29364f100cab1fe8cbd8a5949a228541181ea36a71093f21c5b27983ed95563e70d2afb1c553f226775624d3b57a958967bf31c8b76","ssdeep":"","tlshash":"b32187a89eef68c2663f5418067fc5143556312b034bd774343dd5e21f29d21630d934","size":1347,"data":"","first_seen":"2026-09-22T01:02:48.951499Z","last_seen":"2026-09-22T20:40:23.967683Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/dd2c02fcc07ca8f27d1be616b9e708e8/js/bootstrap.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.573Z","timestamp":1790109576573,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/dd2c02fcc07ca8f27d1be616b9e708e8/js/bootstrap.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:24 GMT\r\netag: \"6a876bd8-126dc\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb59c1d5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75484,"size_decoded":17382,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"894d79839facf38d9fd672bdbe57443d","sha1":"11277f4e04cf070a350e566b053ef2215993720c","sha256":"dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2","sha512":"34fffaf69de2045e8b90adaf72c6c3d73b99bb581832ee7de1be78d34753a3ba97d3aa1b8527ec1747d25e27594e4e0a4a9104e1e7ede811ab748aa1b766842c","ssdeep":"768:K/Lx8D6XlsB92TiwZi7vu6EBI7v8vaSx4ElvhLxs7St8PsBdZsWSdA:wVGihuv8ySx4EosbyWQA","tlshash":"af7340167af921614b5b30ba8cdf614c7238901b550bd42878ad93d46f50b38a2bbffd","first_seen":"2023-03-07T01:03:32Z","last_seen":"2026-09-22T20:40:23.937292Z","times_seen":3036,"resource_available":true,"data":null}},"time_used":425,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/7868a0c0682d315640732b3f66b428fe/bootbox.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.574Z","timestamp":1790109576574,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/7868a0c0682d315640732b3f66b428fe/bootbox.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:24 GMT\r\netag: \"6a876bd8-3b73\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb59c1f5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15219,"size_decoded":5461,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"832ccef3a524e3aab9a927025f123e0d","sha1":"da2b7f5d7c628d9a593bf2fd39e535a5cd396e37","sha256":"d49a7723c795b85f0eeb2837252a2222f5acf8d7cee50a430139c60301dfb87f","sha512":"0231433942a90ff3ecdbaecffad735d38d0f429c6bf99bddf4733a71e1a4f21b13083faecbebdc034af24c07ceea05a7a7a990af80300abdfde16008983dfaad","ssdeep":"192:S3DonwtyclQglxZTog1Oa3PXAJCWxf/ryjC37BSVD+smarw3pfsmllrxHJGbHcZ8:SzowZqg1LwuI6wRwbH2OcJv3+","tlshash":"1d625f48a8fb23620ab371b9179f6658f639c523150cfe10395d03e11fa542a96ff7ca","first_seen":"2025-07-02T21:54:35.483181Z","last_seen":"2026-09-22T20:40:23.93818Z","times_seen":25,"resource_available":true,"data":null}},"time_used":420,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":420,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/jquery-overrides.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.579Z","timestamp":1790109576579,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/782b39a213efcad569c157790524e787/jquery-overrides.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-45a\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac335697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1114,"size_decoded":1031,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"8d3fadf8c5aee04e8830cde5360c4f36","sha1":"005874a88fa82ade27e14a02c95914085d2534b4","sha256":"4007aa7cd65a5c4d764634dc905896b59eb19af32f32dcfbdae0ff76dc6c3ba4","sha512":"ed9109c0532b0855d4a9198922997894dba4cdf399112b59455c657f96dd4233bbc122cacb59ced72f174f38021eb657ec7e8254f7bdd4c0cf829afdd94408ed","ssdeep":"","tlshash":"4421af4428fc41a65cbf2077a5f14f9267994877100a56a5b18e6bb05fd4f2e27ef320","first_seen":"2025-07-02T21:54:35.507725Z","last_seen":"2026-09-22T20:40:23.939741Z","times_seen":20,"resource_available":true,"data":null}},"time_used":433,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/dd2c02fcc07ca8f27d1be616b9e708e8/css/bootstrap.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.363Z","timestamp":1790109576363,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/dd2c02fcc07ca8f27d1be616b9e708e8/css/bootstrap.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:23 GMT\r\netag: \"6a876bd7-23a0d\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb44a615697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":145933,"size_decoded":22447,"mime_type":"text/css","magic":"ASCII text, with very long lines (386)","md5":"2dbb985a5bb6dd8ef0a7b21d290ea9ae","sha1":"f8676e1f4a902a63088f45982f3f9b6a6c401b47","sha256":"d170052c16caec3810f2dee6456539045d8e326f6d8ed7c7f78e59ed34de348a","sha512":"986ed7a3a5cb950d772463d02e02f123b6f3f10944aebb04f6b6100d1805fba0254079bd4e7e5b87fbda20ac4198cf6650b3c2eb28b30211262b21a0347088be","ssdeep":"1536:RP2v8UU8K3LVH5h8BICxV3gzUNbDYv8/nG/BP9IZpHWJ23yJ8:RyUNLhmIGgAdU8/G/BP9IZpHWJ23n","tlshash":"bae394d8f6b039403223c09835939e52b71da143d41fed7ab7a235acafc91958573b8a","first_seen":"2023-04-07T10:31:45Z","last_seen":"2026-09-22T20:40:23.940497Z","times_seen":1656,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/js/App.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.579Z","timestamp":1790109576579,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/33cda7334577b06e9bdcfad88de7757b/js/App.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-dcd\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac345697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3533,"size_decoded":1573,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"4c33747474d7932a398dce46de96a017","sha1":"a0db930a6ff42da6c938befe7b8dd5068568ae89","sha256":"73836032bf79103e7f6eed38392eebed6f2d37b789dd88c7a9e4b65d2b0d4b02","sha512":"6e1996c9ca19acdfbf4dc036f8bfb698fc23baf846c6390b78a5db37fe014d9c887d69902aef75df9b0661f1bce42a5eed6663a068ee8aa6075ad7b66787af63","ssdeep":"","tlshash":"1d71c305eae2206061ffd0ed4ebf5300696650db6285cc8df9bc1ad0dfb8939d2d69d8","first_seen":"2025-07-02T21:54:35.50527Z","last_seen":"2026-09-22T20:40:23.941219Z","times_seen":24,"resource_available":true,"data":null}},"time_used":392,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/images/scotiabank-logo.svg","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.590Z","timestamp":1790109576590,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /images/scotiabank-logo.svg HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: image/svg+xml\r\nserver: cloudflare\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: W/\"671971ff-4fcf\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncontent-encoding: br\r\ncf-ray: a3f41eb5bc4a5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20431,"size_decoded":6337,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4320d83c0e1607bc6bcffc201b0e9812","sha1":"3102c0e9ba9e7d195567d2d45df331fff7dcddba","sha256":"10b00547abde5855f4a4b2ca90277cba93141e83bda6140878f1a2b25d70da26","sha512":"987a6c852cb877d834d6f56ee57a14d352b656e073fe903e03072d5505b36c05fd23fbebe93c674a6cc1bf8d26208167f6f88c9ea03866e9f127c0900d696b63","ssdeep":"192:pBNEMhuhh1iO50ZhQz7RnQLzFO8FJzs8ZfRXD/UpPeMhot0LaBdN6A2T93:fJwhh1iy0vQ1QVO4JhHD/UNeFdN6A2T9","tlshash":"61921f4e9751b3f4f103e3b8a835c1c639f6288f72210d15b5af5c066b6baf648e6427","first_seen":"2025-07-02T21:54:35.497885Z","last_seen":"2026-09-22T20:40:23.942455Z","times_seen":24,"resource_available":false,"data":null}},"time_used":435,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":435,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/images/scotia-large.png","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.591Z","timestamp":1790109576591,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /images/scotia-large.png HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: image/png\r\ncontent-length: 47586\r\nserver: cloudflare\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: \"671971ff-b9e2\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb5bc4c5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47586,"size_decoded":48153,"mime_type":"image/png","magic":"PNG image data, 3262 x 594, 8-bit/color RGBA, non-interlaced","md5":"a3efadb2f29bb3e6a0527fff19615546","sha1":"5013f5429d64e2d245bb0e9280b04cbcd3a6b708","sha256":"32361aa42fdabe1d84fcf4887dada64b77c988d89bebb2a86722a17f71268561","sha512":"2875c5d7545209baeffd35a7a30b21a950e69b52c29fc7fece459b14d7d436b1a20150d1a7801fa00251b6b704ba817b99f3ce0bac3de2a472941dc7f8849edc","ssdeep":"768:OyUddlxA17iaX42SPzO1KsBpREfFNujG0pAQY207SxKUwocmjy0X/8LYhxiyy6y8:ODQXp8aQspEfXuS0o207SxxwYy0v8GFR","tlshash":"9323e1aeec51abbdd76b0136b07d0e02f396051fc2c139a81f79dba41d76a2c5d580e1","first_seen":"2025-07-02T21:54:35.492302Z","last_seen":"2026-09-22T20:40:23.943864Z","times_seen":24,"resource_available":false,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/images/favicon-scotia.ico","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:37.551Z","timestamp":1790109577551,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /images/favicon-scotia.ico HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: image/x-icon\r\nserver: cloudflare\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: W/\"671971ff-47e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncontent-encoding: br\r\ncf-ray: a3f41ebbbb655697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1150,"size_decoded":898,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"82ccea44dba1244b59b4e7d3939162da","sha1":"0cd568bb430352cf78692bf24fdd3bf483d0685d","sha256":"c4347725596f80432ba161d80f4b5df649ae736af1f4ae8f221e6193e8deeeb3","sha512":"2354dc1729b59000e8ec44af9818a864f817f23d64c75ae2d48915c7324fddfb18898a4b7dd109ab4e426d1df4cd4ffc3830deda18ae9d4e4cd602fa5f3d7c66","ssdeep":"","tlshash":"aa215cfc7121df2edd94233dc566572018da1e310df8b5471a11be894cb348bc611bc6","first_seen":"2025-07-02T21:54:35.500466Z","last_seen":"2026-09-22T20:40:23.945314Z","times_seen":24,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":131,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/js/swal.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.583Z","timestamp":1790109576583,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /js/swal.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: \"671971ff-29b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb5ac3e5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":667,"size_decoded":941,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"c3f472ee03c2d6165606331765df930a","sha1":"44824d7f6f8d69de2d704e4e6a72d1c8faf7ed00","sha256":"faf160af0163aa80b6e93da8edd8c12bb70a07dc0b1c4d11119631e93c990136","sha512":"780f029324297a035099f0718bba7c8424afc93d912a120cd7dddbe4190bfb4c9ca61b0dfa7ede57729d5a37c0792be41877c1b0968131b7e60bba58e10ec3d0","ssdeep":"","tlshash":"79019ed1f9bf273a0c3aa27214cf3315452064a35d0928f5b888a7d46f4d17897d3f48","first_seen":"2025-07-02T21:54:35.484519Z","last_seen":"2026-09-22T20:40:23.947014Z","times_seen":24,"resource_available":true,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":442,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/css/site.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.370Z","timestamp":1790109576370,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/33cda7334577b06e9bdcfad88de7757b/css/site.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-26d8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb45a6d5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9944,"size_decoded":3096,"mime_type":"text/css","magic":"ASCII text","md5":"87f85f5841c7b81ae3cdd6f9c6b55829","sha1":"813931b79ccc86722c2be6ba3b66c7c6b08eb684","sha256":"2f005e82f637abac4af8bb362631f9b449a3b415a203a111b8fc9f51da996b35","sha512":"3cb3e61b2d046cb1f936827f9764b2c69e67f52fc810267205c9db77ade584e514d62eb77a0c5b1e7fe61720eb3b5387db3f9e61a59073516a3c3e787b52fbe7","ssdeep":"192:eyHOHqVFen31jcxcFxFXlVbm/HJFGFeFGNMUR:aHkFO1jcCFxFSFGFeFGjR","tlshash":"d9227293bbf97804701f402c609adbf57bad9181490edf797af2b1ac7f492902462f85","first_seen":"2025-07-02T21:54:35.481985Z","last_seen":"2026-09-22T20:40:23.948573Z","times_seen":24,"resource_available":true,"data":null}},"time_used":418,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":418,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/dist/sweetalert.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.561Z","timestamp":1790109576561,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/33cda7334577b06e9bdcfad88de7757b/dist/sweetalert.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-595e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb58c015697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22878,"size_decoded":4427,"mime_type":"text/css","magic":"ASCII text","md5":"fe7cbe4172da0e43de467e4a30ba02ae","sha1":"3f94ab3ee858f17cdf0e6a49559ccf51545c7fd5","sha256":"3428aef40b6b61d82e02be978da6cc49d662a21400714dcfe93a4f97d58a723a","sha512":"54b93834fa4a5e86de1946789b948cfb79ee24808a5745a0fdf6669b0f02c6a50364c54576f225befb08406dabc2a3abe469526c54c022fc085e996a3c9d8e17","ssdeep":"384:MKFzaS3yF8FzfZivFZFsFx2FFF01GF7xGxTxGxJwdD3qX1YtiemnEzpazAP:MKFzaS3yeFzRivFZFsFkFFFhxGxTxGxe","tlshash":"cda233eb1de31284a727874553de4b2827384083a81bdcad77cd519ecf81eec21dab56","first_seen":"2025-07-02T21:54:35.497149Z","last_seen":"2026-09-22T20:40:23.950419Z","times_seen":24,"resource_available":true,"data":null}},"time_used":401,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":401,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Lato","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.566Z","timestamp":1790109576566,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css?family=Lato HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://sb-invoices-old.castineapps.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 22 Sep 2026 20:39:36 GMT\r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":774,"size_decoded":1049,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"98e279faae11b60b01b3fad919ce13be","sha1":"8ac03eee80ee8fd37129ee7500a5877642e45eb9","sha256":"eafe40853325aa2a8172690347ad08deabfbd918181feb135d7ba5817966d232","sha512":"77f31dcfeb5b47a3e5a9f377e65587b6230363e7f016e48464f371bbb4d0487e53245e66b5d5ddb59b00345c27372340a9aec7aa4671c1001a797fe2a60b58de","ssdeep":"","tlshash":"6f01bd91096ba40897830cc612cd7d32ef1f624064499821eeff14d8bc67c699362b0d","first_seen":"2025-09-17T00:10:35.559729Z","last_seen":"2026-09-22T22:35:44.030747Z","times_seen":30260,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":-1,"dns":3,"connect":17,"send":0,"wait":35,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/b56acc504e261818570e2af4ab2ff088/html_checkbox.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.575Z","timestamp":1790109576575,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/b56acc504e261818570e2af4ab2ff088/html_checkbox.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-30b\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb59c205697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":779,"size_decoded":992,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (779), with no line terminators","md5":"73f32980a460b09c196e825336107588","sha1":"bb27d4a68fc8134d5bb8612ac79fda6738338b11","sha256":"f70f424bc6442b58fb0f9131640de53977e657128fd5846f6b5f322aeb828384","sha512":"671ee469e581c6531d290f36e43529f0e43892bc66f4ce66b742fe4d5bbc8267f0b0d7b020a2abe54a554d88061af0ab8154d2e59e720b3d43afc11a8055d0f1","ssdeep":"","tlshash":"5901b8993942f162bbaeb59441dae4036221785ed1270840e2a20e8bbb24e3c7173909","first_seen":"2025-07-02T21:54:35.493815Z","last_seen":"2026-09-22T20:40:23.952518Z","times_seen":24,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":419,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/6edc20316b2d865fbedae36cd1a0ffb7/fonts/fontawesome-webfont.woff2?v=4.7.0","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:37.119Z","timestamp":1790109577119,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/6edc20316b2d865fbedae36cd1a0ffb7/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nReferer: https://sb-invoices-old.castineapps.com/assets/6edc20316b2d865fbedae36cd1a0ffb7/css/font-awesome.min.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 77160\r\nserver: cloudflare\r\nlast-modified: Thu, 20 Aug 2026 21:04:24 GMT\r\netag: \"6a876bd8-12d68\"\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb9087f5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":77160,"size_decoded":77743,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 77160, version 4.459","md5":"af7ae505a9eed503f8b8e6982036873e","sha1":"d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c","sha256":"2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe","sha512":"838fefdbc14901f41edf995a78fdac55764cd4912ccb734b8bea4909194582904d8f2afdf2b6c428667912ce4d65681a1044d045d1bc6de2b14113f0315fc892","ssdeep":"1536:/MkbAPfd1vyBKwHz4kco36ZvIaBfRPlajyXUA2jVTc:L0nXnHdfRVEAS2","tlshash":"7d7302e63b6c4943e03d6460708abe9f104b3ab42fe057e5c876db7f2722992b71552c","first_seen":"2023-04-05T03:30:47Z","last_seen":"2026-09-22T22:48:51.259489Z","times_seen":543573,"resource_available":false,"data":null}},"time_used":382,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":381,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/1c90e423150d143076f8f39f73d87de6/bms.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.572Z","timestamp":1790109576572,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/1c90e423150d143076f8f39f73d87de6/bms.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-9b6\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb59c1c5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2486,"size_decoded":1395,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2486), with no line terminators","md5":"e3fcd6ed9d84ecff013d5a518285572b","sha1":"3bb30e318ac3073662820426e3b51cde90d4e9b8","sha256":"8bb2f91c5e0ad8fbe4d229dbb919423955a1eafbe2214ec282359d9d431e5ffe","sha512":"5ea8942743bb851517e19756ed9e9faa461e156e0a19ec859e153cc5621d98017f0dc83c3881818c39f6241ba22834e8f5e99e8f6a2c156a673b1ebe4a149ef5","ssdeep":"","tlshash":"2b511448b89df06b02fb60a5117b3f0b71549d67c70e090093b191adaebad59f832f49","first_seen":"2025-07-02T21:54:35.499454Z","last_seen":"2026-09-22T20:40:23.954641Z","times_seen":20,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/styles/scotia.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.361Z","timestamp":1790109576361,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /styles/scotia.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: \"671971ff-114f\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb44a605697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4431,"size_decoded":1745,"mime_type":"text/css","magic":"ASCII text","md5":"32b3f07ce0ac1cb6cfa0483b90110842","sha1":"3eaef71d5f10b02516debf51fe89577d367f4237","sha256":"f057a06f8c48ad6234daccec38cf402fe525c9d6aedf942ca67d75aef229f94d","sha512":"5829b16cccda4e5d9967bdfc68ba5a39390b50f4e2450fa21facd9adcd9e672ef4317ab56b668ce3b9f0a29cf89d54b5519a9090d1d928bef2ea0741a0589364","ssdeep":"96:UF4KaKT+KrE1rIbM/FItQOkC2G3AnQ4r+:A4Ly+ubaHC2G/7","tlshash":"d5914752f6f33847301b055d12e7e7b92f7e10c25949cf3e37a6b3a04f4528a6925e89","first_seen":"2025-07-02T21:54:35.489447Z","last_seen":"2026-09-22T20:40:23.955279Z","times_seen":20,"resource_available":true,"data":null}},"time_used":396,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":396,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/aux-styles/select2-bootstrap.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.563Z","timestamp":1790109576563,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /aux-styles/select2-bootstrap.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Wed, 23 Oct 2024 22:00:31 GMT\r\netag: \"671971ff-3b94\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb58c035697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15252,"size_decoded":4008,"mime_type":"text/css","magic":"ASCII text","md5":"335198ffe0fa621cbf7db4b0af3d73f5","sha1":"66250d17ab4bb6b55e3afbd78d1badaadf08822c","sha256":"74cd48fd90a5503b8500efe5e0bb9674e2567363ecdf69ac4de419aeef7ede8c","sha512":"1b64cf66b44b47a6bb4c1ada8d1288ee17dd6c2013a2ad07c54932dc66c5ff3df6b9c5550ce30038cfce3e71d8e689154733a767371cfb5c76bd3493e7164025","ssdeep":"192:ciYGkrk631dG/F3i4asQXQSQzAz4JFuzRQSNcj31AS9TaCPWjTfY:zE56/Fy4asGfB4JFuzOXT7ag","tlshash":"1f62fd9e8add6872707e4a9fedf585c2a74c804f84205b9e72579028dfcd860272bf47","first_seen":"2025-07-02T21:54:35.48846Z","last_seen":"2026-09-22T20:40:23.95595Z","times_seen":24,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/d7d0d25991fdc879d353c149eb937755/jsencrypt.min.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.569Z","timestamp":1790109576569,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/d7d0d25991fdc879d353c149eb937755/jsencrypt.min.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-db4e\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb59c195697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":56142,"size_decoded":18499,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13814)","md5":"64507221feddff84c80b99c98827d76c","sha1":"5c7000638c6bae1a1c448367822a8682d59d371f","sha256":"5a0be406a1bdf94a25a9d142d4124e3dccbdeb5593cd78fb0bd234df89dd7389","sha512":"cc3beba9e9c0d1e149642c41b2bcb351972f8a1bcd9445dbb5e32feb6c91c5d851e2cecad5a6b3f8b8ec4727e4e8cf9824bc80244baeaae20023c23c1a02c2f0","ssdeep":"1536:cJxLSEwwmr2yZPp8yQPj6OR1fdfqovoRonm7f6T:cPErPp8yQPOOR1fdfqg2l7f6T","tlshash":"cb43e9853ae6b075039a50f0051f084ab13ab92e192f44ecf699d8e17cb584d637ffb9","first_seen":"2023-03-07T13:16:24Z","last_seen":"2026-09-22T20:40:23.957248Z","times_seen":21647,"resource_available":true,"data":null}},"time_used":407,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":407,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/extend.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.578Z","timestamp":1790109576578,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/782b39a213efcad569c157790524e787/extend.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-3b8\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac315697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":952,"size_decoded":1109,"mime_type":"application/javascript; charset=utf-8","magic":"ASCII text","md5":"2a6e0af62c7f7c9c84d0b2fdab807aed","sha1":"288bcbb51741500d83a5dde6da0889612a4e5094","sha256":"7f5c1794e78826553b1d32a98b97fc8a275fc62e327d2818ccfab85912249d15","sha512":"5f74692f01bf093afa721402b456274e577eb9d0396bc2d1b1c100cd558c6a1b9c4874d29a32252e78be53852dba2ee58d723afd5c8da76c40a4ccfd058a4783","ssdeep":"","tlshash":"b0119e08fde23875652272a48b5fa41465befd571368cca17a4c62ea1f6103486fcee8","first_seen":"2025-07-02T21:54:35.506108Z","last_seen":"2026-09-22T20:40:23.957947Z","times_seen":24,"resource_available":true,"data":null}},"time_used":441,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/js/fns.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.581Z","timestamp":1790109576581,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/33cda7334577b06e9bdcfad88de7757b/js/fns.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-ab9\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac395697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2745,"size_decoded":1748,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"c0ab0e1a1d0d65c91d59d55b46ce11d0","sha1":"8cc5799ba94556d7f94b5c66c95af69ea63fcbfd","sha256":"d3cea083d5fdee814d28521ff1b808a48bc76e9032421d398e47e029a25712ff","sha512":"967ff063b50fe9659ffa0a9d1f6d9c691ef8b7385eb5638989d24f0b06bbfd35e1ddf0d557e8d9baa82cc567e6e0be3f0d4ee2e12258c7e15c4c4c85e33146be","ssdeep":"","tlshash":"fe515648b4f669f4852270784b5f7400f279dd93116cd974be9c9ea41fa442883fdbe8","first_seen":"2025-07-02T21:54:35.494792Z","last_seen":"2026-09-22T20:40:23.959176Z","times_seen":24,"resource_available":true,"data":null}},"time_used":960,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":960,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/lato/v25/S6uyw4BMUTPHjx4wXg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:37.118Z","timestamp":1790109577118,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/lato/v25/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://sb-invoices-old.castineapps.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 23580\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Mon, 21 Sep 2026 15:52:30 GMT\r\nexpires: Tue, 21 Sep 2027 15:52:30 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Mon, 15 Sep 2025 17:09:41 GMT\r\ncontent-type: font/woff2\r\nage: 103627\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":23580,"size_decoded":24393,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23580, version 1.0","md5":"e1b3b5908c9cf23dfb2b9c52b9a023ab","sha1":"fcd4136085f2a03481d9958cc6793a5ed98e714c","sha256":"918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537","sha512":"b2da7ef768385707afed62ca1f178efc6aa14519762e3f270129b3afee4d3782cb991e6fa66b3b08a2f81ff7caba0b4c34c726d952198b2ac4a784b36eb2a828","ssdeep":"384:dRkIAJ8pVwWTW5VVjdVn8+2yvAMdriCEOY0kfW9GkAPqpPHi2vUuUSzB8:dKIAJ8pVHTZ+riY9oCpPHiodUeK","tlshash":"91b2e1ce5d546e3a8028213785c17b488273572e9edf42c6dd83a6263a7092cfd3d96e","first_seen":"2023-04-05T13:28:45Z","last_seen":"2026-09-22T22:54:02.211414Z","times_seen":269391,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":3,"connect":32,"send":0,"wait":17,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/6edc20316b2d865fbedae36cd1a0ffb7/css/font-awesome.min.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.367Z","timestamp":1790109576367,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/6edc20316b2d865fbedae36cd1a0ffb7/css/font-awesome.min.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:24 GMT\r\netag: \"6a876bd8-7918\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb44a675697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31000,"size_decoded":7681,"mime_type":"text/css","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-09-22T22:53:11.05364Z","times_seen":317293,"resource_available":true,"data":null}},"time_used":406,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":406,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/utilities.css","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.369Z","timestamp":1790109576369,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/782b39a213efcad569c157790524e787/utilities.css HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/css\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-475\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb45a695697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1141,"size_decoded":1139,"mime_type":"text/css","magic":"ASCII text, with very long lines (1141), with no line terminators","md5":"bed3b3422f4021e5119c03e845226418","sha1":"51a81f0c205c1a0465f7ceb1ea45feadda411b9a","sha256":"cbd0cf18da56044de526a397dc61b3f64e4f3d9ec4ff935ccbff19e1739bc9a2","sha512":"a6717fc4298a184b3a4643d5ad76be6deea09dd78bde7299a2dc22cb86a2d50acbb7c1f5508f812212b08ace57e6962e2d9df0aee0114fb2bace040d3e8ed093","ssdeep":"","tlshash":"01211e13e121b639b3538b2a61c4f082b940c603a2e306b09a9315bd99d39f61bc2339","first_seen":"2025-07-02T21:54:35.491393Z","last_seen":"2026-09-22T20:40:23.96182Z","times_seen":24,"resource_available":true,"data":null}},"time_used":414,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":414,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/3bad3e813ea594e56c867256b5e49079/jquery.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.567Z","timestamp":1790109576567,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/3bad3e813ea594e56c867256b5e49079/jquery.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:22 GMT\r\netag: \"6a876bd6-45a82\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb58c155697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":285314,"size_decoded":87667,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"12e87d2f3a4c8b347ab13a0764d420a3","sha1":"4be715e11048c057fdf2ee0fbbfad4dbf3504c55","sha256":"78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe","sha512":"fa4d699e582de05d47f0beeddf3f79a37fca3bea3bf083447174db9e8250fc5d95a835615a86a256697f3841eff47b1583151a556f886e264f50941f17f63167","ssdeep":"6144:gwsmYhct1SS+TC1lmhTzeKRYcYmD2zK8USJsdZQ/coLGVFyy/RgL/uiOgeNTIPfz:FuYcYmD4/cZQ/coLGVFyCJTiPf7AqqAV","tlshash":"e954a3d8f78d112e423231aaad2e12cdbb7dd171561454aefd4d497c24a083c83baf7a","first_seen":"2023-09-15T16:51:13Z","last_seen":"2026-09-22T20:44:13.252885Z","times_seen":18398,"resource_available":true,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/782b39a213efcad569c157790524e787/utilities.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.576Z","timestamp":1790109576576,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/782b39a213efcad569c157790524e787/utilities.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-1089\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac2d5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4233,"size_decoded":2185,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (4232), with no line terminators","md5":"12be02c1f866e3c36af4f344fad5e96e","sha1":"da27fe92d58d2763325988ec457cc0e7c2ace6d8","sha256":"96886deb334392eea487c3fb73b28d8e36583e7a9351dbf5e1bedd819300a027","sha512":"e7a6b84ed15fa75ae1cfde90e6e8324cc54f36439108363b734b70429fdf6557fb73f7f6c711c8e3c876beefc7cdcd8050bdbed4d489acb0b1f464542d3050ec","ssdeep":"96:V42gv9N6eAosKon0eiHYSX+YuYjPLIiaZ9Cf6IfID:VvgpRsKo0eZSX+YuYjPLIinfa","tlshash":"a491635d38a9b0a923fbb0a3116f1e0a7166be3bc0154540d0a385fd2d7de49e4a3f26","first_seen":"2025-07-02T21:54:35.504394Z","last_seen":"2026-09-22T20:40:23.963722Z","times_seen":24,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/33cda7334577b06e9bdcfad88de7757b/dist/sweetalert.min.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.582Z","timestamp":1790109576582,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/33cda7334577b06e9bdcfad88de7757b/dist/sweetalert.min.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:37 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 22 Sep 2026 20:39:36 GMT\r\netag: W/\"6ab2e788-4251\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: EXPIRED\r\ncf-ray: a3f41eb5ac3c5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16977,"size_decoded":6134,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (16977), with no line terminators","md5":"0068f44b0aa1b83fa7679860ceb26590","sha1":"20d5cdb9d2002442843baab241f2e883563d1de5","sha256":"7a056fc64aba501090c8acd106b0c7bbc9a267914e695ae34aa42a6ae2a094a7","sha512":"ed54e2cbd021a5acc178a40096168b45493e9003006fca1cce58eec891cfb153d6a31fd02170c53a74fd0d4935502f046e71ca45d428c13eec3817bb2c08da8d","ssdeep":"384:Rixwo5U75rT3rOlgkhzj7qRM0I2XyySyTXmy9ti/IEUVRj6KaVnzZduTQRc8exfx:RiU3rfRMbwd9t2UVR2KaVz/uMRc8exp","tlshash":"5772b84d315438b313a765f150af8147a4b15abde80998a0366cc4e61ff8c8e6ae2f77","first_seen":"2023-03-07T01:15:37Z","last_seen":"2026-09-22T20:40:23.964936Z","times_seen":4262,"resource_available":true,"data":null}},"time_used":467,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":467,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/auth/login/local","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-22T20:39:35.656Z","timestamp":1790109575656,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /auth/login/local HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nset-cookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; path=/; secure; HttpOnly\n_csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D; path=/; secure; HttpOnly; SameSite=Lax\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-content-type-options: nosniff, nosniff\r\nfeature-policy: camera 'none'; vr 'none'; accelerometer 'none'; autoplay 'none'; microphone 'none';, autoplay 'none'; camera 'none'\r\ncontent-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdnjs.cloudflare.com  browser.sentry-cdn.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com; img-src 'self' data: fonts.googleapis.com; font-src 'self' fonts.googleapis.com fonts.gstatic.com; media-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; object-src 'none'\r\nserver-timing: cfCacheStatus;desc=\"DYNAMIC\", cfEdge;dur=49,cfOrigin;dur=387\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nreferrer-policy: no-referrer-when-downgrade\r\ncf-cache-status: DYNAMIC\r\nvary: accept-encoding\r\ncontent-encoding: br\r\ncf-ray: a3f41eb02da05697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"032c2cc6b54933dc44804cddfd246ca3","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"","partitioned":false,"raw":"PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; path=/; secure; HttpOnly"},{"name":"_csrf","value":"901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"Lax","partitioned":false,"raw":"_csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D; path=/; secure; HttpOnly; SameSite=Lax"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Cloudflare Browser Insights","description":"Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Analytics","RUM"]},{"name":"Sentry:5.15.5","description":"Sentry is an open-source platform for workflow productivity, aggregating errors from across the stack in real time.","website":"https://sentry.io/","common_platform_enumeration":"","icon":"Sentry.svg","categories":["Issue trackers"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Bootbox.js","description":"Bootbox.js is a small JavaScript library which allows you to create custom modal dialogs using Bootstrap modals, without having to worry about creating, managing, or removing any of the required DOM elements or JavaScript event handlers.","website":"https://bootboxjs.com/","common_platform_enumeration":"","icon":"Bootbox.js.png","categories":["JavaScript libraries"]},{"name":"SweetAlert","description":"SweetAlert is a JavaScript library that provides alternative alert and modal dialog boxes for web applications, with customisable features, aiming to improve the user interface of the default browser dialogs.","website":"https://sweetalert.js.org","common_platform_enumeration":"","icon":"SweetAlert.png","categories":["JavaScript libraries"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9919,"size_decoded":5200,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (848)","md5":"fe2560b09fc431b85a2e14d96d3f35a1","sha1":"7b381608238ecace0da331a183789e654e5815b7","sha256":"f1bad8ace12ce3ba46bb4f6f5909f6cc0cc871954f204b782db3fe1fd7a18a4e","sha512":"17441fe3abc8540e7d91ee1c9abdb667a59d84c40407740e70da5e725a34564ae5ce373d39db4fe16f46fabee97967d5dd01cbb698954f3589bf18b7c1ee1bbc","ssdeep":"192:vgBSC8wGILBJx5MgF0RJT2zAdiLtCBMmhZ37C9bfLSE19MqOq4qaeAKj7x534O20:E7MgFVsBMS7k7LSE19MjbNeAKj7v39+I","tlshash":"8422c6219cf40c73216269d876b6fb19aa85c61bc707ce1833fd97d51fc2d9a8913728","first_seen":"2026-09-22T20:40:23.965552Z","last_seen":"2026-09-22T20:40:23.965552Z","times_seen":1,"resource_available":true,"data":null}},"time_used":489,"timings":{"blocked":0,"dns":14,"connect":1,"send":0,"wait":446,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sb-invoices-old.castineapps.com/assets/260a82b4a0d9832c0e6a0e96eb27b588/yii.js","fqdn":"sb-invoices-old.castineapps.com","domain":"castineapps.com","tld":"com"},"ip":{"addr":"104.20.25.41","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://sb-invoices-old.castineapps.com/auth/login/local","date":"2026-09-22T20:39:36.571Z","timestamp":1790109576571,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"sb-invoices-old.castineapps.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 20 Aug 2026 20:02:09 GMT","end":"Wed, 18 Nov 2026 21:02:03 GMT"},"fingerprint":{"sha1":"DC:2C:68:F7:5C:56:15:41:54:C8:AC:ED:EC:11:4E:8D:BD:C6:CF:BA","sha256":"21:6D:AB:77:C5:C5:2F:B2:13:03:8E:00:6D:5C:D3:20:1F:BE:EC:59:4F:36:BE:23:9D:7E:55:B7:55:C0:4C:73"}}},"request":{"raw":"GET /assets/260a82b4a0d9832c0e6a0e96eb27b588/yii.js HTTP/1.1\r\nHost: sb-invoices-old.castineapps.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://sb-invoices-old.castineapps.com/auth/login/local\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: PHPSESSID=032c2cc6b54933dc44804cddfd246ca3; _csrf=901d57ddb9edfc733d16af280cdf6cd3a7aed2e7d2172c23a624f7da16b72162a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22VTOZiKqwUSlULgwqhe_D1xB7rQr10bSb%22%3B%7D\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 22 Sep 2026 20:39:36 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nlast-modified: Thu, 20 Aug 2026 21:04:23 GMT\r\netag: \"6a876bd7-51d9\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nx-xss-protection: 1; mode=block\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nfeature-policy: autoplay 'none'; camera 'none'\r\nreferrer-policy: no-referrer-when-downgrade\r\ncontent-encoding: gzip\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\ncf-ray: a3f41eb59c1b5697-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20953,"size_decoded":6556,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"45b4d3c3e9f50d5c63231e72b016e8cb","sha1":"dbbd08db02a4443bb46560aace36a0d4177af14c","sha256":"995516724f69e24ddf82e9279a65d50a6f64a2c325226f7133bda794d6bf79a5","sha512":"b803690a7284b5fe36541353b86bc081c5f93915eb09d5b98e830e6c92150a1b85e814b4e9bb4d5ae80c92e137188243f20accc2687f567c19f28f8b6ae0b874","ssdeep":"384:Oj0RfTossjpOkUeUnMkx8QfiZ9/lvitSlu11pNAd5:c0RfTosxkURMk2QfMpi0luzpOd5","tlshash":"0892a3197de330a32077747e9b9f4098a675901b212ace503c4c97b84f54eb986f2fe9","first_seen":"2023-03-07T12:10:45Z","last_seen":"2026-09-22T20:40:23.966991Z","times_seen":1882,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-22","alert":"Phishing Block","trigger":"sb-invoices-old.castineapps.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-22","alert":"Sinkholed","trigger":"sb-invoices-old.castineapps.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}