{"report_id":"ef44c7d5-5b33-4a68-b9ec-35cba2d19cc4","version":0,"status":"done","tags":["phishing"],"date":"2026-09-02T13:30:29Z","url":{"schema":"http","addr":"bridgemanstt.com/tw/Redirecting.php?email=phishing@ird.govt.nz","fqdn":"bridgemanstt.com","domain":"bridgemanstt.com","tld":"com"},"ip":{"addr":"192.254.185.229","port":0,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"title":"Track \u0026 Trace | Service\u0026Support | SF","dom":{"size":792481,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e1ed6004a748cd96ac006b9662302896","sha1":"052a5602b7571558e32da2ca260fdf05793d8fb7","sha256":"4848ac9d01701d3ca020349c75f2a10173767512d217773d03254328b5ff9e8f","sha512":"ff0120e970f6b2dc63e68afe72220e29846aedb4697e321afa92ec4da8eaf0f5e39c394336791dc44a292532bbe20c2dec9915c483aa2dd4b86de9c8c8431a9b","ssdeep":"12288:v5MBvBx5TA9PTnfKnd4UNsgcV1ebCOJOp4uthyr32v4RNsgdw1OtCtEtpzXuoD4K:v5UJH4geyuT4","tlshash":"20f4c75a5bb310551813faac27da6b042f30e293c90acca97fdd624ccf8799499d37c9","dom_hash":"domhash744a7f07f3f1fd041f0238270836bcbb","first_seen":"2026-09-02T13:30:34.76613Z","last_seen":"2026-09-02T14:42:20.596309Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bridgemanstt.com/tw/Redirecting.php?email=phishing@ird.govt.nz","fqdn":"bridgemanstt.com","domain":"bridgemanstt.com","tld":"com"},"ip":{"addr":"192.254.185.229","port":0,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-07T13:30:29Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"bridgemanstt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]},"summary":[{"fqdn":"bridgemanstt.com","ip":{"addr":"192.254.185.229","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"domain_registered":"2023-05-02","domain_rank":0,"first_seen":"2025-08-07T04:43:35.490856Z","last_seen":"2026-09-02T13:22:24.993783Z","alert_count":1,"request_count":1,"received_data":342,"sent_data":530,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"project.finansa.biz.id","ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-09-02T13:30:29.883236Z","last_seen":"2026-09-02T13:30:29.883236Z","alert_count":1,"request_count":15,"received_data":911181,"sent_data":9085,"comment":"","tags":null,"fingerprints":[{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.4.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"www.sf-express.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2000-05-15","domain_rank":226468,"first_seen":"2012-12-08T09:00:45Z","last_seen":"2026-09-02T04:41:40.259883Z","alert_count":0,"request_count":2,"received_data":0,"sent_data":1140,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7e9244ca5b84c41d9bb7fdca6f34a7f","sha1":"8cc7af56dc57be69f7af1182cac064820d2fa014","sha256":"19f7f7fd2d6e98a3294da8aac4796adc94b9d000ecc662c3a9908ca8218a5fe9","sha512":"e08658f00db08e97d4fb9249bd23876dd46ded30f7e6785f9fec3342486ed02eadda4dbc95bd3ced6d349bcd3f1237583496852fff6e70c6533b2d51e6a88827","ssdeep":"","tlshash":"0fa0220e0b02ac3080b2b023ff0fb380303f022b800b0800ce288080ec3a82f8c020cf","size":71,"data":"","first_seen":"2025-05-30T12:26:03.910961Z","last_seen":"2026-09-02T15:11:43.267408Z","times_seen":737,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"ec30aeb75253369dacc563df652d0c13","sha1":"6f89e7f599d99dcd343082bc0135eb51bfcf7732","sha256":"25e2ad784a2ff6755449e5e6c1d9f9f3e61e988e5761eb8f74ae5c9f4ac3203a","sha512":"17f350bec333617fe6277137f397297729ed0c350cf86dbc9888556e16281f028574dfc44bba13f361dcc217f1638bd99b657ddd5ee84cf8c60c245ce4585cd8","ssdeep":"","tlshash":"7e01f978191722326d128529771ba3183ebf5063110beb05bc2c8a892fe1c67d6f9fc8","size":828,"data":"","first_seen":"2026-07-16T00:05:28.799533Z","last_seen":"2026-09-02T15:11:43.270067Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"8df7ffe7df449eeeadc1c3fb34337eff","sha1":"46cc8200161aba4d0ca91264c0281e88b5067698","sha256":"7726fcac2c1f23c4fdf728481be4aac71f0e4132506b3dc96c70885651cf335f","sha512":"586ab257314f0f1b088c462643961fb2985be49061369c1719ce9b6f567dc3778f187a342e898ba34dfc093410d821a99e6217bf647e096abfbbbbf9bd807092","ssdeep":"","tlshash":"aa51bd09f4eb21a61573707e2f7f500526a9458b140cde187d7db9806f24b2bb9ba6c1","size":2742,"data":"","first_seen":"2026-07-16T00:05:28.800753Z","last_seen":"2026-09-02T15:11:43.271632Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/assets/jquery.min.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"bceabde9d4ba653fd1f4bb171bff0c01","sha1":"c8cdd4f8e91a77cddbc6d9ce8d5f302c52d74b6f","sha256":"7496a1a9d658f14a47f7ee8dfa70840e47efa61b55b02cda8b316b0fc8dcc2c5","sha512":"d55626e499791f1b6880df4c74ec8cbd5d0c0413a228c403259ac1d65b608c42ca5e473fcf1e0d24a7ae04156405ba46472fd0002573b1c9cbe61325fa0973d0","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98E:u4J+rlfOhWpgCW6G9a98Hr4","tlshash":"1283c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","size":85584,"data":"","first_seen":"2023-03-07T12:02:41Z","last_seen":"2026-09-02T15:11:43.260736Z","times_seen":1400,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/6de6e0a.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.291Z","timestamp":1788355797291,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/6de6e0a.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":306,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":306,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/aec8211.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.305Z","timestamp":1788355797305,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/aec8211.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/no-data.343cdf8.png","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.394Z","timestamp":1788355797394,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/no-data.343cdf8.png HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1162,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":274,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":274,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/f7ff5a6.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.286Z","timestamp":1788355797286,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/f7ff5a6.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.sf-express.com/_nuxt/icons/icon_64x64.70e147.png","fqdn":"www.sf-express.com","domain":"sf-express.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:58.152Z","timestamp":1788355798152,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /_nuxt/icons/icon_64x64.70e147.png HTTP/1.1\r\nHost: www.sf-express.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-02T16:18:01.529784Z","times_seen":18238627,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"bridgemanstt.com/tw/Redirecting.php?email=phishing@ird.govt.nz","fqdn":"bridgemanstt.com","domain":"bridgemanstt.com","tld":"com"},"ip":{"addr":"192.254.185.229","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-02T13:29:54.374Z","timestamp":1788355794374,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bridgemanstt.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Jul 2026 20:06:19 GMT","end":"Mon, 05 Oct 2026 20:06:18 GMT"},"fingerprint":{"sha1":"1C:89:7F:30:67:07:B3:B7:44:0F:CE:84:ED:12:35:05:7A:22:85:2B","sha256":"0C:F5:7D:8B:2E:9B:31:B7:6C:36:EB:9B:30:C1:E4:B7:8F:C6:93:7B:A9:12:71:8F:5B:6D:D7:AD:A5:20:0D:8C"}}},"request":{"raw":"GET /tw/Redirecting.php?email=phishing@ird.govt.nz HTTP/1.1\r\nHost: bridgemanstt.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Wed, 02 Sep 2026 13:29:55 GMT\r\nserver: nginx/1.29.8\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 0\r\nlocation: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\ncache-control: max-age=7200\r\nexpires: Wed, 02 Sep 2026 15:29:55 GMT\r\nx-server-cache: false\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-02T16:18:01.529784Z","times_seen":18238627,"resource_available":true,"data":null}},"time_used":942,"timings":{"blocked":0,"dns":354,"connect":165,"send":0,"wait":252,"receive":0,"ssl":171},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-02","alert":"Sinkholed","trigger":"bridgemanstt.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/assets/jquery.min.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.620Z","timestamp":1788355797620,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/assets/jquery.min.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 25 Jun 2025 20:56:28 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 29178\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":85584,"size_decoded":29397,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (32065), with CRLF line terminators","md5":"bceabde9d4ba653fd1f4bb171bff0c01","sha1":"c8cdd4f8e91a77cddbc6d9ce8d5f302c52d74b6f","sha256":"7496a1a9d658f14a47f7ee8dfa70840e47efa61b55b02cda8b316b0fc8dcc2c5","sha512":"d55626e499791f1b6880df4c74ec8cbd5d0c0413a228c403259ac1d65b608c42ca5e473fcf1e0d24a7ae04156405ba46472fd0002573b1c9cbe61325fa0973d0","ssdeep":"1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98E:u4J+rlfOhWpgCW6G9a98Hr4","tlshash":"1283c6d9b2d6706297b734b850bf410bb17a98dab44c8c60f059d4e47eb4a8e507bf2c","first_seen":"2023-03-07T12:02:41Z","last_seen":"2026-09-02T15:11:43.260736Z","times_seen":1400,"resource_available":true,"data":null}},"time_used":319,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.sf-express.com/_nuxt/icons/icon_512x512.70e147.png","fqdn":"www.sf-express.com","domain":"sf-express.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:58.151Z","timestamp":1788355798151,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /_nuxt/icons/icon_512x512.70e147.png HTTP/1.1\r\nHost: www.sf-express.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-02T16:18:01.529784Z","times_seen":18238627,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/9eccc8e.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.304Z","timestamp":1788355797304,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/9eccc8e.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":294,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":294,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/sf-code-img.9c3b712.jpg","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.618Z","timestamp":1788355797618,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/sf-code-img.9c3b712.jpg HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/20549e1.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.289Z","timestamp":1788355797289,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/20549e1.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/c6c37c7.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.296Z","timestamp":1788355797296,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/c6c37c7.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/a93c6e2.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.300Z","timestamp":1788355797300,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/a93c6e2.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/4Y2M.png","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.622Z","timestamp":1788355797622,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/4Y2M.png HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":542,"size_decoded":730,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"6ea79acd684fac5851c86cd80ece3127","sha1":"cf1e4fe6a8ccceee1787816ea5145b3191de91a8","sha256":"65c82550361c7d3b04c242e37841e146dcf6f88373015e112876dbcaca4b5fab","sha512":"0e435c21f1bb5b69ae92179c09f2baa27d9a426bf1fef3a00804a26236ff341dfc4e695e4e7e6bea8d335add05f306128390d902f22cf860bdc5e03c61f187e3","ssdeep":"","tlshash":"97f0e126c082941ea0235070d480e27045a40150a3db1f103f9eb573e48d19615760dc","first_seen":"2026-09-02T13:30:34.769593Z","last_seen":"2026-09-02T13:30:34.769593Z","times_seen":1,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":319,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/govIcon.2f477dc.gif","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.623Z","timestamp":1788355797623,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/govIcon.2f477dc.gif HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":984,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/star4.png","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.621Z","timestamp":1788355797621,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/star4.png HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":129,"size_decoded":317,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"1b62825585e3127288a53ac06516c5c4","sha1":"9634a9a63b14f5113a01cc17479f7ff041b2d287","sha256":"d3c5d28068ddbd4a56acc081cbdaf362e88a700fbf7143a7ee58bf1350a6da53","sha512":"aed221e7474f397bf2ed9124d3ea030fc2ecbf223803173d0e249f2129c59d959c2a9e69ccac5a71085f8d2f341798ec6f3c3e2ed30f7ec7851842088ec02db6","ssdeep":"","tlshash":"c9b02ba38011581c40204151e840b02005514ad023171d001ec5752b28d432845300cc","first_seen":"2026-09-02T13:30:34.77111Z","last_seen":"2026-09-02T13:30:34.77111Z","times_seen":1,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":318,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-02T13:29:55.324Z","timestamp":1788355795324,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nx-powered-by: PHP/8.4.24\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Wed, 02 Sep 2026 13:29:56 GMT\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"PHP:8.4.24","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":812808,"size_decoded":127534,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"8e283e7e0687873f0da878dff524a451","sha1":"582d2a61d414c3631e09b74a2c43e3fa0f7458b8","sha256":"220f76a839abcf3ac96bc4588aac0b8c9a806cb71386a7b1833833a7fa3f81d8","sha512":"c6501b5d84ff5ea6922aa9f641ea3486a2f3496492451c98001c9868c37daef55f706c3907b8e2a9ba09a5257d2491d1e49dc59e9efaf7da3577ed3c357fc239","ssdeep":"12288:U5MBvBx5TA9PTnfKnd4UNsgcV1ebCOJOp4uthyr32v4RNsgdw1OtCtEtpzXuoDy6:U5UJHyS7w6V5","tlshash":"7305d61a6bb310551817faac17da6b042f30e293c90acca97fdd624ccf8799499d37c9","first_seen":"2026-09-02T13:30:34.772269Z","last_seen":"2026-09-02T14:42:20.601476Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1750,"timings":{"blocked":-1,"dns":439,"connect":261,"send":0,"wait":528,"receive":0,"ssl":520},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"project.finansa.biz.id/,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/21d95c6.js","fqdn":"project.finansa.biz.id","domain":"finansa.biz.id","tld":"biz.id"},"ip":{"addr":"15.235.193.207","port":443,"asn":16276,"as":"OVH SAS","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz","date":"2026-09-02T13:29:57.288Z","timestamp":1788355797288,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.project.finansa.biz.id","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 06 Jul 2026 11:38:04 GMT","end":"Sun, 04 Oct 2026 11:38:03 GMT"},"fingerprint":{"sha1":"9F:38:3B:E6:24:E1:3C:9D:E5:AB:1F:CB:74:91:78:7F:05:F8:AD:3C","sha256":"30:D9:EE:F3:F8:B4:7D:6B:D2:EE:19:99:C7:66:B7:66:32:EC:95:E5:A0:58:5B:39:F0:13:28:EE:93:F9:89:C2"}}},"request":{"raw":"GET /,/cn/sf_marley/sf_marley/Track%20\u0026%20Trace%20_%20Service\u0026Support%20_%20SF_files/21d95c6.js HTTP/1.1\r\nHost: project.finansa.biz.id\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://project.finansa.biz.id/,/cn/sf_marley/sf_marley/?email=phishing%40ird.govt.nz\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Wed, 02 Sep 2026 13:29:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":null,"data":{"size":796,"size_decoded":1004,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-09-02T15:19:35.683637Z","times_seen":56861,"resource_available":true,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}