{"report_id":"ed4d731c-b518-4418-93d3-f1b22c7777dc","version":0,"status":"done","tags":["amazon","phishing"],"date":"2026-09-19T08:03:05Z","url":{"schema":"http","addr":"vofnbo.com/","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":0,"asn":48753,"as":"Ava Host Srl","country":"Moldova","country_code":"MD"},"final":{"url":{"schema":"https","addr":"vofnbo.com/","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"title":"Amazon","dom":{"size":90685,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65474), with no line terminators","md5":"e717f7a4cfd7974f0d12b7fecbc7b1a8","sha1":"a06eb13adf9c089641c26fb3e14cb59ce271e078","sha256":"d46b4862c50e5e2ea1f47ab22cbdbf19e6d1302c4d39916ef46b0c3d47d234fe","sha512":"a86abfd0d42a043cfbfbac6bd4f238a68ed72deb26cae30a3e45e25129c86238051e57dc18a0cb4bf5be25806ec7696a6b1781c2c4b176c96454c55dc5d19e3f","ssdeep":"1536:gdOvP7PdOvP7VdOvP7udOvP737/y4vewF9Xnstx6TdMG:SOXJOXfOX8OXL7oe93sNG","tlshash":"28931a12fb20052256b3e5d8d196bf363f91f357845689a02bedbde08ed3c78792503a","dom_hash":"domhash177c3d52db0f068c1c6bfb59c751261e","first_seen":"2026-09-19T07:23:25.226452Z","last_seen":"2026-09-19T08:05:15.09492Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vofnbo.com/","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":0,"asn":48753,"as":"Ava Host Srl","country":"Moldova","country_code":"MD"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T08:03:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"summary":[{"fqdn":"vofnbo.com","ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":112,"request_count":16,"received_data":9014974,"sent_data":7816,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-13T22:43:30.72904Z","alert_count":0,"request_count":3,"received_data":29963,"sent_data":1596,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-09-13T22:43:30.746969Z","alert_count":0,"request_count":6,"received_data":231408,"sent_data":3384,"comment":"","tags":null,"fingerprints":null},{"fqdn":"m.media-amazon.com","ip":{"addr":"151.101.65.16","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2016-08-18","domain_rank":3022,"first_seen":"2017-01-30T05:27:40Z","last_seen":"2026-09-17T14:30:26.261133Z","alert_count":0,"request_count":4,"received_data":478854,"sent_data":2240,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"vofnbo.com/","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"cdc54e369f65edc719c17ef53a7bcc8f","sha1":"f1936812638d7710e915d51eeca0d87722985613","sha256":"3f2efb532326b3d9687b2e3b27134870fc9c8dbf9245601828a1ac29e7cdb790","sha512":"4cf5869686636517fd6076f695d19318857474e59aac47df984c8f3f3381bf6c7726e01cebd934d11f5b936058f9111ea001085d3f5ad9a6809edbe703f9d808","ssdeep":"","tlshash":"67014cd668610034597332688b2ba604bb33403f3407c53679ac83952f3783fda595de","size":842,"data":"","first_seen":"2026-09-19T07:23:25.30613Z","last_seen":"2026-09-19T08:05:15.119746Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/js/chunk-vendors.ab6d9949.js","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"18d78ab16ed1024137f5685ac7079aff","sha1":"f0087cc954491b41d91b4b734095f76816c67d46","sha256":"408c93727ba4105e367041e8db1017dfcb9ce50733979487a48ffe51899cdf0e","sha512":"46e4fc5267d4466d13f1cf71d3ebc7a7b4b25915385720c9e867b8760075d4141b807dea00b360f0551353ce956b18c51699bd05b8236c7d730ee1d2e6b63f87","ssdeep":"12288:xPUwWf3C/TPklN2atq14MHA6VTuYlP0mUGC7W:xPUwWfC/TqKHNVT1lP0A","tlshash":"c10508cd72c5b57247e360b1003f250bb33b2a98a8098098f679d4e96db990d526ff7d","size":866161,"data":"","first_seen":"2026-09-19T07:23:25.299422Z","last_seen":"2026-09-19T08:05:15.10426Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/js/app.2f8652ac.js","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":false,"md5":"a7ecbe0da764d18ca66caa7dcb691835","sha1":"09eb2b944925ab03cd00588931e37ce8408faa45","sha256":"68a7ee024dfe5659f091e9f659702d9de683387c3a89f7f74d56f8d9f9bd6091","sha512":"37778ab20c892661ca1d46a857142d25ad1a3db6032768654d36c082c37353ea9e679b1afcc54cbad4a3a0eec8e59c24765face5486ca92a01fa60880f0b162b","ssdeep":"1536:2fxBie/JhDlgajJBZggnstxC4vewFTOvP707/UaOo0g3qg3J:2fxkefltjvi+sseTOXo7gm3r3J","tlshash":"fec32ad2cd91a06f9e5782c0512f3571e4b65efe5460c2c1ffb8d98029aa4e4e73da2c","size":127784,"data":"","first_seen":"2026-09-19T07:23:25.285661Z","last_seen":"2026-09-19T08:05:15.105185Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vofnbo.com/img/touxiang%20(1).bc1654cf.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.673Z","timestamp":1789804952673,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/touxiang%20(1).bc1654cf.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f19-3847\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14407,"size_decoded":14904,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 304x292, components 3","md5":"709b7e30ace23ab6720636029cdebe4e","sha1":"235c6d771f3d91ab49210e92da45b91294b8032e","sha256":"068aaec3eaeb4060c18ef53ffea261cbe931165800b680729b9d854de9d94af4","sha512":"789a87b22a02b5b8a017da5a83455daa4075946e33f6dd2659397dd80efc5e74f2d4b3d9f9372aac9d0516ba4c34104833ede9b5dec36fa4e2b6f112850978ff","ssdeep":"384:w7i6rhCAdcwwR2fP8DxbE8H3N//7abMPihug8ADXZQ/JyfL8S:J6rE9wwR2fPkS8H5japfDX7fLv","tlshash":"8452c066bf9a001d65a099f3f94472711f389bbe4d7d83c85545d7182bbfba4340682c","first_seen":"2026-09-19T07:23:25.234697Z","last_seen":"2026-09-19T08:05:15.100276Z","times_seen":3,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":110,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.178Z","timestamp":1789804952178,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Montserrat\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 19 Sep 2026 08:02:32 GMT\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1976,"size_decoded":1247,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"328ca8c17bf61719aac8fdc0068832bf","sha1":"4b797ce331028743ff960c4e9ed7933202f6e37c","sha256":"e5a1f089b1109784ed9370c25589beceba8c3a8f537ecb201443062363589ba8","sha512":"4ea18e8ebf94f049a3fbba780a88c434bd74b66e6099641a780bf1dd438ceb7a23c50faced8af4319e113f324336fd1a32561041466e48c36f403f8fc82b2895","ssdeep":"","tlshash":"56419d811117a500eb471cc923cf7e26dd4e656374a0c079affd5c98ade9c220739b6d","first_seen":"2025-09-05T02:14:13.393041Z","last_seen":"2026-09-20T12:31:37.175981Z","times_seen":12253,"resource_available":true,"data":null}},"time_used":89,"timings":{"blocked":-1,"dns":4,"connect":15,"send":0,"wait":32,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.702Z","timestamp":1789804952702,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":22,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T08:02:31.550Z","timestamp":1789804951550,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:31 GMT\r\ncontent-type: text/html\r\nlast-modified: Fri, 18 Sep 2026 15:55:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f01-680\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1664,"size_decoded":1297,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (812), with CRLF line terminators","md5":"30735c9f78f24780507a6f32d4baa09b","sha1":"541a05a357a26682fc9aed3d0121f3c2f52c43d5","sha256":"2252c4912ea3d1d85f0ab328f7ffecd55b0dc02b92bc17f25e45b3d2447f0848","sha512":"630907bf507f486ee4f3fd9752a3e652b73b285d9863d8acec2bb15d4adcd4fb2844cf7bd877092eabe1d85f95d4d11aace288ca4d7331667503290f07b8f700","ssdeep":"","tlshash":"ea31fec79c1040392a717395eb26b70cf9a7003f2d52842179bd82a92fb9a7fc959ccd","first_seen":"2026-09-19T07:23:25.244129Z","last_seen":"2026-09-19T08:05:15.115914Z","times_seen":3,"resource_available":true,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":5,"connect":53,"send":0,"wait":53,"receive":0,"ssl":115},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/js/chunk-vendors.ab6d9949.js","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.181Z","timestamp":1789804952181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /js/chunk-vendors.ab6d9949.js HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 18 Sep 2026 15:56:15 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f1f-d3771\"\r\nexpires: Sat, 19 Sep 2026 20:02:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":866161,"size_decoded":239963,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65488), with no line terminators","md5":"18d78ab16ed1024137f5685ac7079aff","sha1":"f0087cc954491b41d91b4b734095f76816c67d46","sha256":"408c93727ba4105e367041e8db1017dfcb9ce50733979487a48ffe51899cdf0e","sha512":"46e4fc5267d4466d13f1cf71d3ebc7a7b4b25915385720c9e867b8760075d4141b807dea00b360f0551353ce956b18c51699bd05b8236c7d730ee1d2e6b63f87","ssdeep":"12288:xPUwWf3C/TPklN2atq14MHA6VTuYlP0mUGC7W:xPUwWfC/TqKHNVT1lP0A","tlshash":"c10508cd72c5b57247e360b1003f250bb33b2a98a8098098f679d4e96db990d526ff7d","first_seen":"2026-09-19T07:23:25.299422Z","last_seen":"2026-09-19T08:05:15.10426Z","times_seen":3,"resource_available":true,"data":null}},"time_used":117,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"m.media-amazon.com/images/I/61VN4e-f+bL._SL1000_.jpg","fqdn":"m.media-amazon.com","domain":"media-amazon.com","tld":"com"},"ip":{"addr":"151.101.65.16","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.668Z","timestamp":1789804952668,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images-na.ssl-images-amazon.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Jun 2026 00:00:00 GMT","end":"Thu, 07 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"AA:AB:50:BD:9D:27:19:6E:E8:3E:53:EA:FE:54:FD:45:6A:C2:C2:48","sha256":"04:D4:83:D5:76:45:7B:3C:25:35:6F:4F:97:D6:4C:03:F5:6C:3D:47:2E:5B:8C:1E:DE:1B:D1:EF:03:77:50:94"}}},"request":{"raw":"GET /images/I/61VN4e-f+bL._SL1000_.jpg HTTP/1.1\r\nHost: m.media-amazon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 127832\r\ncontent-type: image/jpeg\r\nx-amz-ir-id: 30a05639-291b-4fd3-b487-b56a8199cf48\r\ncache-control: max-age=630720000,public\r\nlast-modified: Fri, 29 Mar 2024 19:16:26 GMT\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: https://www.amazon.in, https://www.amazon.com\r\nexpires: Thu, 23 Aug 2046 13:49:21 GMT\r\nx-nginx-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 268097\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\nx-served-by: cache-fra-eddf8230188-FRA, cache-bma-essb1270066-BMA\r\nx-cache: HIT from fastly, MISS from fastly\r\nserver-timing: provider;desc=\"fy\",cdn-cache-hit,cdn-hit-layer;desc=\"s\"\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":127832,"size_decoded":128530,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x1000, components 3","md5":"e92cf0ad51ba171f3e19a4b0833a06de","sha1":"5426b35111dd96e67c30bfcd63566bc0591ba991","sha256":"31cc3a17dd4b01bce5af32f3bbd773e284989ec0223ce508397286fedcde6142","sha512":"2867d060409d6c549cc268322e3d44d71946c1dcbf1af1383884ed7be8fffea0ec97d5bf83565981ceb0153e4bf8303271a7ce062c1dc8bea2c115ae1d5e71b3","ssdeep":"1536:Ko5Y3/6gvRy2rJjjsTjh4UIcMf/S/EBnjQyHs4cR0tlevTzfQenrJiblmMBdydxY:K4O6gvfr+xPMfq8BnH9wTBJiwXM","tlshash":"5ac302f48dd4963ac99ec63c8073dfef98ea35299891b90f3710ddb30a460d58a25ed4","first_seen":"2026-09-19T07:23:25.252345Z","last_seen":"2026-09-19T08:05:15.117123Z","times_seen":3,"resource_available":false,"data":null}},"time_used":327,"timings":{"blocked":-1,"dns":2,"connect":8,"send":0,"wait":34,"receive":13,"ssl":268},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.694Z","timestamp":1789804952694,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":3,"connect":30,"send":0,"wait":18,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.media-amazon.com/images/I/619wM8FXMyL._SL1000_.jpg","fqdn":"m.media-amazon.com","domain":"media-amazon.com","tld":"com"},"ip":{"addr":"151.101.65.16","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.668Z","timestamp":1789804952668,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images-na.ssl-images-amazon.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Jun 2026 00:00:00 GMT","end":"Thu, 07 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"AA:AB:50:BD:9D:27:19:6E:E8:3E:53:EA:FE:54:FD:45:6A:C2:C2:48","sha256":"04:D4:83:D5:76:45:7B:3C:25:35:6F:4F:97:D6:4C:03:F5:6C:3D:47:2E:5B:8C:1E:DE:1B:D1:EF:03:77:50:94"}}},"request":{"raw":"GET /images/I/619wM8FXMyL._SL1000_.jpg HTTP/1.1\r\nHost: m.media-amazon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 99281\r\ncontent-type: image/jpeg\r\nx-amz-ir-id: e6f5c908-3b1a-4c07-96cd-34717529cc6f\r\ncache-control: max-age=630720000,public\r\nlast-modified: Fri, 29 Mar 2024 19:16:23 GMT\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: https://www.amazon.in, https://www.amazon.com\r\nexpires: Tue, 11 Sep 2046 05:31:44 GMT\r\nx-nginx-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 167469\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\nx-served-by: cache-fra-etou8220055-FRA, cache-bma-essb1270066-BMA\r\nx-cache: HIT from fastly, MISS from fastly\r\nserver-timing: provider;desc=\"fy\",cdn-cache-hit,cdn-hit-layer;desc=\"s\"\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":99281,"size_decoded":99978,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x1000, components 3","md5":"303ca9ae8b1290449896ebf9032639d0","sha1":"5db91387d8014f28f574e7fe63b13158893b46e2","sha256":"628011cfebd7fd06795fd39dc61cd5fb5cda66ade47d4be85ab67262195fa52a","sha512":"e320a472ce17d637e064fa24ec892dc299c1b7a0bf9a7fbffe5d8371412d979a0feb0aa9be88fed3eccd7bef6f7458768732fdef206599f06660101cc56d7e3e","ssdeep":"1536:KvGfNFLhjPLmN0OEW50ne1k1obDC6B8SObVj67IHwiNluA1fBvZ63JIGAhuRbryc:KCVorx50neyGPD+I7C9L63aG+uRbB","tlshash":"09a312b66347edcbd73c0df285285b1aa960078dd8f665ecb09c3608d641b73710a7a6","first_seen":"2026-09-19T07:23:25.274956Z","last_seen":"2026-09-19T08:05:15.106116Z","times_seen":3,"resource_available":false,"data":null}},"time_used":324,"timings":{"blocked":-1,"dns":1,"connect":10,"send":0,"wait":33,"receive":18,"ssl":13},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.700Z","timestamp":1789804952700,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":34,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m.media-amazon.com/images/I/61JHs-Rp2IL._SL1000_.jpg","fqdn":"m.media-amazon.com","domain":"media-amazon.com","tld":"com"},"ip":{"addr":"151.101.65.16","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.669Z","timestamp":1789804952669,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images-na.ssl-images-amazon.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Jun 2026 00:00:00 GMT","end":"Thu, 07 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"AA:AB:50:BD:9D:27:19:6E:E8:3E:53:EA:FE:54:FD:45:6A:C2:C2:48","sha256":"04:D4:83:D5:76:45:7B:3C:25:35:6F:4F:97:D6:4C:03:F5:6C:3D:47:2E:5B:8C:1E:DE:1B:D1:EF:03:77:50:94"}}},"request":{"raw":"GET /images/I/61JHs-Rp2IL._SL1000_.jpg HTTP/1.1\r\nHost: m.media-amazon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 123825\r\ncontent-type: image/jpeg\r\nx-amz-ir-id: 32252e53-b189-417e-bf56-b09c220cdd2b\r\ncache-control: max-age=630720000,public\r\nlast-modified: Tue, 30 Apr 2024 13:21:07 GMT\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: https://www.amazon.in, https://www.amazon.com\r\nexpires: Thu, 23 Aug 2046 13:49:21 GMT\r\nx-nginx-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 220374\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\nx-served-by: cache-fra-etou8220171-FRA, cache-bma-essb1270066-BMA\r\nx-cache: HIT from fastly, MISS from fastly\r\nserver-timing: provider;desc=\"fy\",cdn-cache-hit,cdn-hit-layer;desc=\"s\"\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":123825,"size_decoded":124523,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x1000, components 3","md5":"8ab9dc29ad438939bdaa5087ea14935a","sha1":"8da2e24323e10c4413e0b5c322d379f5c8627f80","sha256":"de7832dee80d4afe553d675b639d60bf63504764eff5dfff70650db6b1eb120f","sha512":"1c033f980a14e9a29d70748c0dda5ead32db81f537e560d3c41b8e8c2116c1e92e7080cd3587bcbcb7834f87f42e0ee63c66d8363b19ecf86e87a8f25de83df8","ssdeep":"3072:KCQRG9pLMuopvbVqSmPCzs+pOPpeyVvfOD3R2Rk1mg5u:7QIPgumJqSCCzwm8+1mgo","tlshash":"dac313775b2276fbe53e7c3016f483e363675909a6db8086e0107cae9d738018d8e629","first_seen":"2026-09-19T07:23:25.230706Z","last_seen":"2026-09-19T08:05:15.109382Z","times_seen":3,"resource_available":false,"data":null}},"time_used":322,"timings":{"blocked":-1,"dns":0,"connect":10,"send":0,"wait":31,"receive":19,"ssl":260},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/img/hr-wiggleline.8bec201d.svg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.672Z","timestamp":1789804952672,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/hr-wiggleline.8bec201d.svg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 658\r\nlast-modified: Fri, 18 Sep 2026 15:56:03 GMT\r\netag: \"6aad5f13-292\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":658,"size_decoded":1098,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c5b73189d16742d51f49e577e76f6cb2","sha1":"93f226a9f75c693e0c1aba386f8b690295cba58d","sha256":"d862899748a67db4c5e279bcf30f817cd187c8adf26efdd7e284a9233c9d1157","sha512":"8619c72772617590af8de9e8900abc6e1c26ec853bd8937fb38ecda5325fc891d49e8ef64f97f6755aea1676662739faa9e01c511e85dfb080a95e038d136fc0","ssdeep":"","tlshash":"f2018b1c05e684255325821297fcac66a13cf097b0490ca5f58d2d39df209cc29873a8","first_seen":"2026-09-19T07:23:25.228093Z","last_seen":"2026-09-19T08:05:15.102202Z","times_seen":3,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/favorites.3104a7f2.png","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.659Z","timestamp":1789804952659,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/favorites.3104a7f2.png HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 18 Sep 2026 15:56:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f13-686888\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6842504,"size_decoded":6844988,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"aa31a2ddcf772fe8319f79243b059195","sha1":"4bae087f34119778b3e905787429a884c81f9443","sha256":"c618d423ff4087da51aa652326c61c707c0574ec18776f566e00f187bc8df5b2","sha512":"4653164dd0502e97c30d0e4103664b8711bf3e884e557766264ee364dd512888ec4d8e4e917199b29539d9dd111cee795675912d7503de2cdfa3aee079b4284e","ssdeep":"24576:mcxe2LM6GQYIWh1PhTyINfuze7T2UcIoH4xRYMGAv36W:7eD6KPFJT7rcI647YMfv6W","tlshash":"3a25236e91833e4af7a0b775e8c2e3974b62104333e196106b3cb83956d5dba2f15387","first_seen":"2025-10-02T15:08:53.238262Z","last_seen":"2026-09-19T08:05:15.108477Z","times_seen":4,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"m.media-amazon.com/images/I/61FBDKvhUFL._SL1000_.jpg","fqdn":"m.media-amazon.com","domain":"media-amazon.com","tld":"com"},"ip":{"addr":"151.101.65.16","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.666Z","timestamp":1789804952666,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"images-na.ssl-images-amazon.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Wed, 24 Jun 2026 00:00:00 GMT","end":"Thu, 07 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"AA:AB:50:BD:9D:27:19:6E:E8:3E:53:EA:FE:54:FD:45:6A:C2:C2:48","sha256":"04:D4:83:D5:76:45:7B:3C:25:35:6F:4F:97:D6:4C:03:F5:6C:3D:47:2E:5B:8C:1E:DE:1B:D1:EF:03:77:50:94"}}},"request":{"raw":"GET /images/I/61FBDKvhUFL._SL1000_.jpg HTTP/1.1\r\nHost: m.media-amazon.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: image/jpeg\r\nx-amz-ir-id: d0906715-0e0c-4631-8293-ec29baf4cff1\r\ncache-control: max-age=630720000,public\r\nlast-modified: Mon, 06 Oct 2025 15:51:38 GMT\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: https://www.amazon.in, https://www.amazon.com\r\nexpires: Tue, 21 Aug 2046 14:31:04 GMT\r\nx-nginx-cache-status: HIT\r\naccept-ranges: bytes\r\nage: 268097\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\nx-served-by: cache-fra-etou8220190-FRA, cache-bma-essb1270068-BMA\r\nx-cache: HIT from fastly, MISS from fastly\r\nserver-timing: provider;desc=\"fy\",cdn-cache-hit,cdn-hit-layer;desc=\"s\"\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 125105\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":125105,"size_decoded":125823,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1000x1000, components 3","md5":"1ad7e627141bc668ad72b2f1e9f0b344","sha1":"364c3aba8814295c148d922f8394f22bab92d965","sha256":"ee0cdd74e6736580fda127374785557de205964571ed88a3bb902c63c01a5c51","sha512":"7bfb4704970b54895f228e73d5177a075dc7ab76d3ccd8a60bbfd31d7d301155fe2c0bf88be93d7a6b42e4ed3283d199dd0fa87ec0c1c1ae7d03aab5fe76c765","ssdeep":"3072:NYI4++SIJRaYNcKBAV5onmxZEcG6VHJiUw7jbidk:yNThch3onmQcvtROx","tlshash":"adc313467e969b3ff5401fba61f71aedd0ae5233aade7a5987264de2321c102c25b040","first_seen":"2026-09-19T07:23:25.246743Z","last_seen":"2026-09-19T08:05:15.115084Z","times_seen":3,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":3,"connect":9,"send":0,"wait":31,"receive":18,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.701Z","timestamp":1789804952701,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":28,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/favicon.ico","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:33.365Z","timestamp":1789804953365,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:33 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 74350\r\nlast-modified: Fri, 18 Sep 2026 15:55:44 GMT\r\netag: \"6aad5f00-1226e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":74350,"size_decoded":74793,"mime_type":"image/x-icon","magic":"PNG image data, 720 x 589, 8-bit/color RGBA, non-interlaced","md5":"4dd91911b613e8a47eefa9744c0eea7c","sha1":"3fdb6505a6674b07a69e7f200f0ffe69c51a8523","sha256":"309d3df30f5aaf77d8c6ed72ce863636634b06192254bc40b0cbed046f0c6020","sha512":"ecfc90f19961e4c2307e9074fd67236bc5c643c6784574bb74533198cf1914255a541b1b6af2fbb2eb0d51fc5f4a15e021e6672afdf6ed1d5470871d7a521ec9","ssdeep":"1536:uPYpDfeCwwCijjJ2UrjO+GEhPIYpoFjpotmNk1ok8Tm1mNN8:uOfeCNrjjsoORjEoppImNk1WmAb8","tlshash":"f0730203db018c5fd6a48d3a04d705897436eca748e6d2a47316fa470afad690cbbf8d","first_seen":"2026-06-24T12:29:43.693944Z","last_seen":"2026-09-19T08:05:15.113444Z","times_seen":43,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/PDP_-_Desktop_-_Frame2_3.8acde57c.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.670Z","timestamp":1789804952670,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/PDP_-_Desktop_-_Frame2_3.8acde57c.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f17-3549e\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":218270,"size_decoded":198671,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 2880x1520, components 3","md5":"ee87a2e7efa45b0e5e0f10cfe9ba2b6b","sha1":"b58b864e2e40f66aef0a8b182d735411a837fa4c","sha256":"acda367582956ff8b5de18c2659cca13136d403cbf205f7cc1c1a302affcdc9c","sha512":"b55f64075c5053609d5c6920d1374590d72f821e01ed70e265c240effdb55b2f883f7ddcb190bd1dd11fa87f049f002c820e1df863d795506e87ce7f8a5e4e92","ssdeep":"3072:VP3rrI/HYaZ3n+w6Vm/TbwHspEWtJ2MEWdif5D5CbgKjT/1bat/XZJll1sEeO8:VDrIvYaV/vwHspXMMhEtYbtRaJthl8","tlshash":"d02402fba3e95993d4456bb145af533736a61c64cb2e92d3c4c60e323c8a0637ee5183","first_seen":"2026-09-19T07:23:25.276536Z","last_seen":"2026-09-19T08:05:15.11844Z","times_seen":3,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":112,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/MS_VARIETY_STACK_10.21.cdcde64d.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.672Z","timestamp":1789804952672,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/MS_VARIETY_STACK_10.21.cdcde64d.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f16-51ba9\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":334761,"size_decoded":321679,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 2222x2222, components 3","md5":"b1a16ebf58b453ac896a85217799a8bf","sha1":"1d8b40247af9fb83dc95f0f0581f5177324ee0bf","sha256":"ed6fd61118c18954122b862471b100271d50cf05db8a7f1f61c54635dcff8eb2","sha512":"e84763f272f1772dcbe9938cb326fdabfe01f5f2063d1c269e1fc5b59df19b6ef5abb767050c06a55c6ccb1af31b3992a0043851c1c4d13083bbcd483de82825","ssdeep":"6144:lJAr9JxkOwN4hFCdLKIpDL393TSi1i8v3V45LVK6ihtnMQMcAYJDI:lSxJlwihcTpvtDj1hv3Vs3+y","tlshash":"d56423875c9850f3e21ead72c37fa71c103891625ede1baf8f702239d550b620abd697","first_seen":"2026-09-19T07:23:25.280472Z","last_seen":"2026-09-19T08:05:15.096197Z","times_seen":3,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":111,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/touxiang%20(3).a330aafc.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.675Z","timestamp":1789804952675,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/touxiang%20(3).a330aafc.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f1b-33cf\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13263,"size_decoded":13703,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 304x304, components 3","md5":"42d1d9376bccdf301b30b6a81890c60f","sha1":"7d1447a9dc22bfd33ac5bbd82a2144a92871fc02","sha256":"4eeb8753d3c61a8f129fb8a7ce8429568451bee9e27d9b2c0073588133f6a1e9","sha512":"1346820ccaa3df175f67fe20fde4158a86bd192ce1e54935e9e917bca5ead4a70056128c6f3e814993a1c0df78d6ccdab4c2ab1e5d247628e7c9b043287ae4b1","ssdeep":"384:iZFuY7yaB+GO+TR8nNGPrIrJbFLJxEiRw+T8zU5hNjaSvR:SF7Zk+KsPrIhVEiRFcw","tlshash":"9952bf1cfe3086f2d8f91e3c0a42363942467eca1368e279ea911993b2bc5cb047566d","first_seen":"2026-09-19T07:23:25.238363Z","last_seen":"2026-09-19T08:05:15.112513Z","times_seen":3,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/magicspoon.87abaf4e.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.676Z","timestamp":1789804952676,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/magicspoon.87abaf4e.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/css/app.361ccd06.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:04 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f14-39bf7\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":236535,"size_decoded":225866,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 2800x1480, components 3","md5":"b4c62142e34757129287f0650e64e3f1","sha1":"5ee4dc09684e1749937c6c0504c520a62c53b923","sha256":"f67fd8c24d8e8df9d2d163a6f672b607c6bd3005dec8150c2afc6cdb80297804","sha512":"95d40cd1eef8be88b0b76c01949d06bac606fc82a394b49bc555a8f997b23a33a1c0c4dce0daef10ab739cbf2f323e62a0ee93f73dbf3f929a7954afdd61f435","ssdeep":"6144:lxzfQcinc9U2c7mvmN4vDOztpnJxDG40eJ6uIlhtUS:nTQcinc9U2omv7OZpn2peehuS","tlshash":"4d3402bbf7f146a2c540a77158022b3a3a42ec96c2da515351d00f3939ed6f4e9f7683","first_seen":"2026-09-19T07:23:25.297554Z","last_seen":"2026-09-19T08:05:15.101263Z","times_seen":3,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.696Z","timestamp":1789804952696,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":26,"dns":1,"connect":0,"send":0,"wait":45,"receive":18,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/js/app.2f8652ac.js","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.182Z","timestamp":1789804952182,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /js/app.2f8652ac.js HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 18 Sep 2026 15:56:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f1c-1f332\"\r\nexpires: Sat, 19 Sep 2026 20:02:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":127794,"size_decoded":52053,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65294), with no line terminators","md5":"a7ecbe0da764d18ca66caa7dcb691835","sha1":"09eb2b944925ab03cd00588931e37ce8408faa45","sha256":"68a7ee024dfe5659f091e9f659702d9de683387c3a89f7f74d56f8d9f9bd6091","sha512":"37778ab20c892661ca1d46a857142d25ad1a3db6032768654d36c082c37353ea9e679b1afcc54cbad4a3a0eec8e59c24765face5486ca92a01fa60880f0b162b","ssdeep":"1536:2fxBie/JhDlgajJBZggnstxC4vewFTOvP707/UaOo0g3qg3J:2fxkefltjvi+sseTOXo7gm3r3J","tlshash":"fec32ad2cd91a06f9e5782c0512f3571e4b65efe5460c2c1ffb8d98029aa4e4e73da2c","first_seen":"2026-09-19T07:23:25.285661Z","last_seen":"2026-09-19T08:05:15.105185Z","times_seen":3,"resource_available":true,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":229,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/css/chunk-vendors.10dd4e95.css","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.184Z","timestamp":1789804952184,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /css/chunk-vendors.10dd4e95.css HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 18 Sep 2026 15:56:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f2a-338cd\"\r\nexpires: Sat, 19 Sep 2026 20:02:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":211149,"size_decoded":35540,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"2142ef8e12eea3ed38edbf3d659ab4fe","sha1":"5ba2ac62ce51f8fda665660c85c404b775be1e75","sha256":"fa6f1d96e529b170226115b7eb039ed98b1c74687495207ff4bf95a8a2ced3bc","sha512":"682d0221cba59c3184a328a96add399a2e9906596b86f7622d4f49c032ab207eac2a6399c2b936afa4d683ddc8f1c315cd9579c9ba997de1fe48d4a6ed0bb6a9","ssdeep":"1536:O28Y7SrW3YeWXA1u9w4HCe/l4JrgW9cMERw4B78O6iZkJgYu8e2B0kSDnvIcNeh5:TtKwT29eDLL6cf","tlshash":"d924a710db17247b622bd6ad74c0ba896f28c363d8725b3bfd95741cc6e64891223e1f","first_seen":"2023-10-18T01:18:29Z","last_seen":"2026-09-20T09:59:34.384929Z","times_seen":234,"resource_available":true,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/css/app.361ccd06.css","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.185Z","timestamp":1789804952185,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /css/app.361ccd06.css HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 18 Sep 2026 15:56:25 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f29-d148\"\r\nexpires: Sat, 19 Sep 2026 20:02:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53576,"size_decoded":9587,"mime_type":"text/css","magic":"ASCII text, with very long lines (53576), with no line terminators","md5":"357903855dbba72c8b0dfa9b8f70481a","sha1":"a76ba558d631ed84dac6d47ea3108a83a04f4786","sha256":"da0762411dad95be8655d29001aafe1c1cf2109aa061124d639b31f37b6674f1","sha512":"634b625dcc26b75f558e6acb4f63a2fa6d3b64fad7b878e5d6c024f548cb0b5eceec2baab09b6ed409c2d57e5889b0ceb9f509ee6c2d595890995f394d5bdbc2","ssdeep":"768:J56u8OXC3XM13ZYjKfhTUZadYWmYiL3r2BDpljUlpylj5mQvv:Ny3CtYWmW8lpylj5mQvv","tlshash":"f5338761f2183018f07be664e5c15b5a3324f713d51782a8bbb9309addc319f2bb2769","first_seen":"2026-09-19T07:23:25.233325Z","last_seen":"2026-09-19T08:05:15.098455Z","times_seen":3,"resource_available":true,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@100;200;300;400;500;600;700;800;900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.481Z","timestamp":1789804952481,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@100;200;300;400;500;600;700;800;900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 19 Sep 2026 08:02:32 GMT\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17343,"size_decoded":1454,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"8099fd2908b8ff98a6fa32c13b3c27a4","sha1":"46fb2e3603399fb539bb43d472601b2c22644511","sha256":"f6ec0c0b2c87c966c56dd4a1622440388bf0da1ca5574d266d1994010a78ea10","sha512":"5d35d28aeb01a832abcf499a571a4e8e3f4e41ac214eedb2e4631e7a81352148c5a1ee172a933b22df8dacc01b0af6d1343c22a5e90506ce93e21de72671a2c2","ssdeep":"192:NpRdp7opQpOPpu9R27hpOYu+RV7y6OfuXRo7TbOmuwRv7M0OFupRS719Ocu6RB7D:Nnd1oWQIOrRPQPTzajdfMfPE","tlshash":"a872ac91105be500e6472cc923cf7e26dd4e21627494c57a7ffe2ca8adeac225325b3d","first_seen":"2025-09-05T06:25:47.318539Z","last_seen":"2026-09-20T12:26:19.043353Z","times_seen":4067,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/URL.txt?v=1789804952540","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.541Z","timestamp":1789804952541,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /URL.txt?v=1789804952540 HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://vofnbo.com/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: text/plain\r\ncontent-length: 27\r\nlast-modified: Fri, 18 Sep 2026 15:57:59 GMT\r\netag: \"6aad5f87-1b\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27,"size_decoded":462,"mime_type":"text/plain","magic":"ASCII text, with no line terminators","md5":"c98166b1c6430565b52bb06894314a6d","sha1":"56fd7a4190f8e23a1b14054866f8d21d84cfd620","sha256":"d5186c200bfbb38903dd41b5eb876e2fc6a03c3c0fff183627446c1d3bbe2084","sha512":"152793f27900ef32f7e3a101bcfd1e7b6f1719efc141d42eb9302e6aedc5b43e6099f1afdb5db83b2e506a23a7534f5ee439459c51a0aa001295c5d8b8931530","ssdeep":"","tlshash":"8080003ba02802223f2008e0c202a00cc0820e080eaa8a808000882c20a00a020a8802","first_seen":"2026-09-19T07:23:25.303883Z","last_seen":"2026-09-19T08:05:15.107643Z","times_seen":3,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"vofnbo.com/img/touxiang%20(2).fd8e983d.jpg","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.674Z","timestamp":1789804952674,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /img/touxiang%20(2).fd8e983d.jpg HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Fri, 18 Sep 2026 15:56:10 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f1a-28ec\"\r\nexpires: Mon, 19 Oct 2026 08:02:32 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10476,"size_decoded":10962,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 304x283, components 3","md5":"393b66cc9b7203de62b6d9c819d5a6da","sha1":"00a31c9dfc5121ee8302c1dc059754272ef1052e","sha256":"bf69cdf0111bcfed87428dc317412ec09a36f42145313a0f26c5e2cb2a7d0c67","sha512":"638beba1d932d698faf583ee43ae143cf840e7dc2a850eccf1ea575f5a872689fe0da201b62c0e7f10f1fcc8114a773941b1df4b331f90b0297530dda1ef49dc","ssdeep":"192:kveaSDbi673gDfUJmcdPNnLnWG9O8vkaKqL/84nrQLkKlcm33TQEaXbZ2pI0zyni:GR673gL2mcVNTJstqLxnEQ3m33RarZ2P","tlshash":"8722c04ce08cc1eed30d5bfce6c32651b146a170b4e1987d03a663a6a035de2dc28f4b","first_seen":"2026-09-19T07:23:25.25501Z","last_seen":"2026-09-19T08:05:15.110371Z","times_seen":3,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.698Z","timestamp":1789804952698,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:14 GMT","end":"Fri, 27 Nov 2026 08:06:13 GMT"},"fingerprint":{"sha1":"FC:62:2C:54:76:7E:15:10:00:DB:0B:9A:29:78:7E:31:F7:5C:17:C1","sha256":"44:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85"}}},"request":{"raw":"GET /s/montserrat/v31/JTUSjIg1_i6t8kCHKm459WlhyyTn89ddpQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://vofnbo.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 37756\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 18 Sep 2026 18:10:46 GMT\r\nexpires: Sat, 18 Sep 2027 18:10:46 GMT\r\ncache-control: public, max-age=31536000\r\nage: 49906\r\nlast-modified: Thu, 04 Sep 2025 17:09:21 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":37756,"size_decoded":38568,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 37756, version 1.0","md5":"8a6a885dd57e60ddd85f3190737fa209","sha1":"dbca56b7fe8ee5e4bfb648d639fc6a3bfc5c6e85","sha256":"b9b102f608e8252e3c1e7287309832b16af7dcc6e788651fa503a3faacd7fb2f","sha512":"2bd785869777dc57dbb5934d4c6915b66f89746dd79897820eb4bbd0d262b2612bafdfb07c1e092658ad819f582a97e6a196531f74187d8a0b0bbd07fcbba56a","ssdeep":"768:sqRKhgpCf9U72WeD4A/5IqtBr0ikGvEaQh38/LBu3Emdc043RpgZKMqjkEfO1m:jKgp+9U7Ve8A/7Ai9Et3EBKEUE3RqMMu","tlshash":"3e030130df5884edcc0ba371fdeea81fc7a332a594c0b3368297af1b80111499d99e49","first_seen":"2025-09-05T00:25:10.258656Z","last_seen":"2026-09-20T14:48:40.981093Z","times_seen":562215,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":25,"dns":0,"connect":0,"send":0,"wait":40,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"vofnbo.com/css/reset1.css","fqdn":"vofnbo.com","domain":"vofnbo.com","tld":"com"},"ip":{"addr":"194.102.104.212","port":443,"asn":0,"as":"","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.176Z","timestamp":1789804952176,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vofnbo.com","organization":""},"issuer":{"commonName":"LiteSSL RSA CA 2025","organization":"TrustAsia Technologies, Inc."},"validity":{"start":"Wed, 16 Sep 2026 13:00:00 GMT","end":"Tue, 15 Dec 2026 12:59:59 GMT"},"fingerprint":{"sha1":"52:56:E2:45:5F:0F:98:59:C5:B5:8D:39:4C:77:81:65:99:48:24:6F","sha256":"07:DD:1E:DF:6A:69:BB:E2:ED:B1:A6:38:D5:E5:AC:AF:D2:A0:F1:13:04:93:DA:10:4C:C7:51:F2:8B:C4:EF:50"}}},"request":{"raw":"GET /css/reset1.css HTTP/1.1\r\nHost: vofnbo.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 18 Sep 2026 15:56:27 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6aad5f2b-585\"\r\nexpires: Sat, 19 Sep 2026 20:02:32 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1413,"size_decoded":1082,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"49a2cd4d77b996e8519885dade62adff","sha1":"149d226112a974d7517f9b265a9a40b70b43dcd8","sha256":"0e7ad3377caa660ecd595cc8790859cd8e4e4c6c02788497b9c694304482403f","sha512":"e7d9a78bea16aabf2e8782b5335bd953aebcab974ef1d800a97ff2407f5bf439fb75b90f34884d8016ac44077931a9a62a605c2f182c7900192c6273df216290","ssdeep":"","tlshash":"3221ac9d9a52208252b99f35b3a68e00fb1801371f8141b6fb8967258f741bc40e2fed","first_seen":"2025-11-25T13:09:58.911181Z","last_seen":"2026-09-19T08:05:15.111458Z","times_seen":9,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"vofnbo.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"vofnbo.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Montserrat:wght@400;700\u0026family=Lora\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://vofnbo.com/","date":"2026-09-19T08:02:32.180Z","timestamp":1789804952180,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Fri, 04 Sep 2026 08:06:15 GMT","end":"Fri, 27 Nov 2026 08:06:14 GMT"},"fingerprint":{"sha1":"4A:94:E8:7C:D6:24:98:F0:09:11:DC:AA:71:9C:1B:6F:0E:37:D6:F9","sha256":"27:EB:1A:85:AA:03:02:5C:92:96:B5:9A:18:1B:65:94:2D:6C:B8:A3:56:3D:E9:F8:5F:E3:62:83:5C:A8:C0:59"}}},"request":{"raw":"GET /css2?family=Montserrat:wght@400;700\u0026family=Lora\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vofnbo.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sat, 19 Sep 2026 08:02:32 GMT\r\ndate: Sat, 19 Sep 2026 08:02:32 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8612,"size_decoded":2265,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"8fb1d3e72b5b90fab9f80373c0a02ced","sha1":"899a9350f7ceaa9ddc395f9d8e21d538468aa89c","sha256":"c38310ec526cf0ea246c0f72c2de5c3c0f7c5d94dc3240b268190a648e212a2f","sha512":"38866cc06383ac078cc1edc6d52c3a9fbb3f41b71d932266e0fa198452174fa3ee47779ddfae321b83c2de0769c4a15c0b20ee150e75d954126ac250aef3663e","ssdeep":"192:10FelqI5bqGIwV4+zA/rRo7TbOmu6RB7W+Oju8:2LkqY4JQJde","tlshash":"f9020e9000179500e7471cc623cf7e26de4e62667094c13aabfe6fa6eddec625364b2d","first_seen":"2025-11-27T15:58:11.759197Z","last_seen":"2026-09-19T08:05:15.103136Z","times_seen":11,"resource_available":true,"data":null}},"time_used":91,"timings":{"blocked":-1,"dns":3,"connect":16,"send":0,"wait":35,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}