{"report_id":"f0f002cf-281c-48cf-97d8-83c1a4f9da5c","version":0,"status":"done","tags":["wellsfargo","financial","phishing"],"date":"2026-09-24T13:45:56Z","url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"title":"Sign On to View Your Personal Accounts | Wells Fargo","dom":{"size":77327,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"f75433c6df7df78d267cdff38f0751dc","sha1":"254fbd1c148185967c80647ce024eed304b4bc28","sha256":"58054e75c1d44394b966847406863f07fda51940720555312b6d28e361b4b194","sha512":"edbeaaa46b7be813b249cc2b3ad3dbf39e55818b50d35b5000f9c8fb205a86906d01396b746e2d071e5c34823e59befe2a4f460f821f2804aad35416e8946c1c","ssdeep":"768:Oh99KgHu5kFUL1OGJ9gaECMJ2LbBvAPHS95djGKgmedEk8sr4fRl9nklEI3gJi5i:OkgHu5kFw3RW6csJELzWmtKJ6a","tlshash":"2173fc3797d1132c6007ce9f5bd5a946517af817e426bbe9b9630522cbcb9c24a2330f","dom_hash":"domhash27275fd315937bb23bebdd619bcdf7e5","first_seen":"2026-09-24T13:46:20.485458Z","last_seen":"2026-09-24T13:46:47.453176Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-29T13:45:56Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"auth-app-ajba9.ondigitalocean.app","ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":90,"request_count":18,"received_data":639033,"sent_data":9103,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"www15.wellsfargomedia.com","ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":196163,"first_seen":"2019-09-12T19:28:23Z","last_seen":"2026-09-15T21:15:19.450963Z","alert_count":0,"request_count":3,"received_data":72752,"sent_data":1724,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www10.wellsfargomedia.com","ip":{"addr":"23.52.23.95","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Sweden","country_code":"SE"},"domain_registered":"2009-06-25","domain_rank":90632,"first_seen":"2017-01-30T08:35:44Z","last_seen":"2026-09-24T00:38:45.576352Z","alert_count":0,"request_count":1,"received_data":508227,"sent_data":606,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/main-3123a443c688934f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5c8fa4faef8700c12dd2c8fe8b29ee96","sha1":"6882f5b250869c46d913875d48ae03c2b9be449d","sha256":"0eed4542b90a01be928023ec3dc7abed45c63ffc8067a496863ecef579d4af9f","sha512":"14f7aa71733af380b5ba661183daf80f68895e6c02908fd09f788407a93a092ae2f040071d6d8748c1072726d3071d6f68f815a2f8d415292b1f5f8f6bd87b8e","ssdeep":"1536:zkF5kayDDfhPDrwJw4lwON7npFW9TR2pS9w:nayIBrnhpS9w","tlshash":"d4a3e7a871e2f882459266b1803f100bf27a5c7af05dac91a39eccd17e74d4ea173f59","size":104950,"data":"","first_seen":"2023-03-07T16:53:51Z","last_seen":"2026-09-25T08:32:44.413062Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/_app-7e0dffbdb63082b7.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c03149fe6a8412303fb7fc7c49ed3e2e","sha1":"4ef2f25990a0733059b1fa7737e463ab6a51948c","sha256":"0a2f88b46163cbcc1031f9ba819d63b6218fd8bbaca360a3842fc10b003e0c9a","sha512":"a657e71cb6c519f7547268fd0d3271637c7183abfca074b9f7a6c95ac2affb2f9f289bf2f55147ee5ee4312e4defc740ad25e3a79e06d6a4237c3bb36361d101","ssdeep":"768:DJL0B04NXIyB/JhjLC0kg6mGtSMJCepPYagDSL5T+e:8nbhjV6mGtSePTgDSL5Se","tlshash":"dfe2f9dd72e2f10687a3e4a640af548bb97dac14b04c4cb6ea80d9d17a784bd4137f9c","size":33480,"data":"","first_seen":"2026-09-24T00:38:51.036296Z","last_seen":"2026-09-25T08:32:44.416772Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/643-49ffaa237a345b9d.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c355a95e04afe3e1b32dbfd458038360","sha1":"d9f67375b6d52d4060e1fe44d887f77af88744dd","sha256":"3d431fcd761bfbdc9592b3f636c8929ad8aa39ab7475122ce156158a1706dff9","sha512":"96d2f57994ac01f49f18ea87e77a9a73979a3b0553e6273fd4681ca0f275d54ced1c3ee077bd408aea90c3090c47aa7516cfe5aff141dcd46694ee0a3bb3acc5","ssdeep":"192:matg+LsetFyOo6iAhTMFSmeDogQlPmm6znQCUT4CR+EsCGSFBVHkgK40:/gHfBFS57ePmm6znBUTvQE3GSRHr0","tlshash":"4362f91aa3d8275e7906c7a4307ba50fb2cf207f72b4cb65e211fa3675118e4146abc7","size":15554,"data":"","first_seen":"2026-09-24T00:38:51.011382Z","last_seen":"2026-09-25T08:32:44.422905Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5352cb582146311d1540f6075d1f265e","sha1":"cbe5dad683f4f887122db6f6d343aa8ba41dee8b","sha256":"e182e3257a3b5564f7bfb9fb1c6a1e13f8f7c9a3fa0dd6e39ccf473ef8d4f960","sha512":"50b05ff9c7703a5997b538c02a177a32bc91ce03de33779039fe5f1eccb1d2b8f04735a24cad024999c0c937160d3fce66a9b1c114a5b8e95e8c11afcff59654","ssdeep":"","tlshash":"a4a001e0943cdc60aa63dd1c136413128fa05122651d28938afd3044c0301510300d90","size":76,"data":"","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.425501Z","times_seen":667,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/139-88233707e5e1051f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"40019529f08d66073ce8fd2b82fa8986","sha1":"dd6e83bcc6bac32b645da9210883fb1edc0c22b5","sha256":"edfba3685111667e6f265d8624bab1c4ad9a454e96f453409f241900d69f9182","sha512":"855705c22da55697d3b114d134fe9d65eae2371ed00047945c2d1cd54379c401276816b31ee9c0d21abafe3decb0376f32a1e3f7ab97f7f082e9a558c8541363","ssdeep":"192:XHJuUu3y/HVvYswWyVoDRZv2U7vb1ZsG0:XHIJ3iumyVoDRRT7vb1ZsG0","tlshash":"d2e1d998d9d57c6ffe2f518acacf4c22f30da820b71d48a5f1b29685115c14813a3bee","size":6989,"data":"","first_seen":"2026-09-24T13:46:20.522851Z","last_seen":"2026-09-25T05:51:01.011778Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/785-194388d0a8adb6a6.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0b132b999b0e4c981df1a6011b1ff04","sha1":"c5ef57811be8018fc738e67f81eff24bc08b2ce1","sha256":"b548ced5d5c606131cb8d49dfefc13b58d6a199229365e5b8964ebb1e4d584a5","sha512":"493824644a07215243494eb76e38848dbef0eec8ad8ed4313c44970ead83c2d40762761d93f8ed67b7d35552dc5701c084854a55f4262d0dcc2888bd333b6c61","ssdeep":"1536:YoFItVhwfdoXHb0juA2ugi+K4RJksHEY/WM859rMbHXKMbxhoVbFxbR:4hFA29icRJksHE2LWyXRhO","tlshash":"1e73d6c4b793b456837a78a4402f400bf27a9db9f04ccc98f2a5d5d2797866d906af3c","size":79898,"data":"","first_seen":"2026-09-24T00:38:51.020899Z","last_seen":"2026-09-25T08:32:44.427394Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/217-fc4ca4bc23c5eb89.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9ac5e786f88fe4efe5a54e23a7786ad","sha1":"14418486bbd22b01ed8d6e93b87ee08e71f34155","sha256":"1f6db8541d75dcacbef78c15894ebc5f8e5d184fb74527ce5a98d8e6a9ec3cd8","sha512":"6d6c14e26caa4bcaefe03d01135a6df9fc5f114e5d5c01edbfdb81eefdc2bffa7bb3b5eca48cc5241193abfddc47ecadb72d0764956b47a182aa8d78841db737","ssdeep":"192:0fCqtsk9qPVGKipX8v89xkvhRMoqlDfqTdba1cKVNNqwoB+K7nxD120Yi6yvn/rw:WptSOXQkuhGoqlDfiQBIX6yvzqPc8","tlshash":"4752f8a8b041b8715a9771e280bf080fb13824a531094ca5f7e6fdd85ef86a84127f9e","size":13293,"data":"","first_seen":"2026-09-24T00:38:51.037789Z","last_seen":"2026-09-25T08:32:44.421505Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/669-339d55ad45077513.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"992799c812675e5cc284338be275216d","sha1":"383f2b719001689266adee39e140b27e57f76d7f","sha256":"2cae64aa1dc40773ef634f794abccec2b44f26ad61d811a8a969d535c6bb34d2","sha512":"a74ad61e9b091c0c098058a8838554f2c587fd17a8f40db2bc59f88f65235064eee02761d2f56b0083425b3e64cf4fcd9d1fc852e2c41045e619bdd416fb4a24","ssdeep":"768:hlbTUeh1RemrALFrjUgLk+VL0I4fJqTeA4Bd1XM6BNgW/9I46ZVtYVLuB:7wmXAxrjUglVL0HETeAsd1XM6BNqLYNQ","tlshash":"8813d685baa6b01283a331e1406f444ff179f939f49c5cb4b280e4e129b49ad857ff6c","size":44954,"data":"","first_seen":"2026-09-24T13:46:20.503913Z","last_seen":"2026-09-25T05:51:01.010661Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/995-23d4606ec37e3134.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb29b5fa3b79aeeceedeb1d67ca017d5","sha1":"05de4faacdf95679f780ee00c0b1ca1d3a65e1cb","sha256":"b7e6d113c49c58b4e723329668f1adaa699eed95036a88f9c25f4db71461b8a3","sha512":"455bf398b623a7d3d07ca6e9451498529e9b570a5421a72cd6ad4bc1da9149eaf25e19577cee5cee7c4e657b80e4e78d5d55c4d213f8fcb8cd9cfe2a1a717ae1","ssdeep":"192:/xH+milOAulOgFcVlbiZl1fZDLPxXidmdnul4m7e0:krgYiZl1fZDLPxXiEnulLN","tlshash":"11f1a4a4fb80f670b96f85cc6def08d5ef7425109b5c1cbaf8a65049025f2c58463e8e","size":7668,"data":"","first_seen":"2026-09-24T13:46:20.531866Z","last_seen":"2026-09-25T05:51:01.006975Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/login-0e179d57d6b907b1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c363f021fe994ec8fa1a29659ce67038","sha1":"ed733a96ade81252ed4de4c361b79f47bc8c9567","sha256":"a8689bba1069a6fe8fbe203c2b2a980dd5aa5f2544124aa47f126aa794084976","sha512":"dc230a9f534c61938d3c2130e86905b978eb28788f60bd2ca91b1d3f14db9a66d4ed8fc2e5021d803bf7a2914e73f4a074dde870777b0b318a110c476c8bccc3","ssdeep":"384:ks3sska04Wv0ZpZI4qOqvdAsZ197L7cRWXmqOqvdAsZ197L7cRWAOOZpN8NeBr36:ks3ssdb+0Z44qOqvdAsZ197L7cRWXmqF","tlshash":"9d82e941a7a8159df403cc8861ff710eb1ef712db1d58da4bbe2ac6928568c43537bc6","size":18862,"data":"","first_seen":"2026-09-24T00:38:51.012921Z","last_seen":"2026-09-25T08:32:44.423537Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/webpack-bb469f829a664d48.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"09985188723a77d0dc96533b3177fb30","sha1":"120be09a92353d98363349d3a6459a296e2bf760","sha256":"5dfe185409ff8cc0e73ea870cbefbcdac38297bbfa69c545686e536f7c51fa64","sha512":"a2d353fda78dd8e922c37d5a555a56af304c0b836da56290a8a453da2c1665c12e59e560de474509ae42bb5602f316488987c8f49ad1d079dcb77df10e287638","ssdeep":"","tlshash":"4b410bd931e6f4d6166b7a60013f481bf02b98f2f06ca4e49354c8f13d7029a9032f9e","size":2193,"data":"","first_seen":"2023-03-07T01:36:05Z","last_seen":"2026-09-25T08:32:44.42433Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/463-d1ffc92465982ad1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"11bf3cd819d9c431721fc48f555fe313","sha1":"c5a1d854ffd15e725157340d55a8930ce527f24c","sha256":"179e5f9b4c0a9481d03deffae6657f5bbed8e09c4ce0111283818378bfa14ab6","sha512":"c3dc4cd13a780b67bdc2b312d026256a64f6b8c58c2d601822c32362be87079cf2c7aebeac979627f9afb07babb936a9c880250a7f9c9f948a06acc9027e815f","ssdeep":"768:ubJa80WZHgVN4Dx5jrqXFqvFnkdgJQQ+WMc5ZnSHX:u9a80WZHgVNWx5jr6qv5kdgJcqZS3","tlshash":"50332ca8f6c1f923a56340d8d1ef442bb7a9b561f70e0c54f177c8c92ba809c5262f9d","size":50776,"data":"","first_seen":"2026-09-24T13:46:20.530935Z","last_seen":"2026-09-25T05:51:01.011243Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/540-a68c3ead76933934.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"31af69e34680f9c8244cc621b9d54d6c","sha1":"af2f86fe9f8ece104f9defc90b0f713c591a6994","sha256":"7c6e8a8d7d4d404770030f9a7a917fd0ab1392fe71b68f32f7f96972d0bf05fe","sha512":"c5fbaa69db3d24626a8f171685449f11cf4e0b764d507356d75aff2bc04e41715e55bd8af0282bc2381d339872d65c35697828a6f299eaf84504095912bf5dc2","ssdeep":"192:F+x+6Wu80ovRhTvFa7XYa267UKskmhM9r4Uz70rk1NnGOOAvCP3:UxEu8pvRhTvsca267UVjM9rxAI1NbLC/","tlshash":"b462e7bcebc0b8264d7bc1cdd6ef481ae66ca061a70918b5f0970d40279d2dd1627fac","size":14918,"data":"","first_seen":"2026-09-24T13:46:20.525194Z","last_seen":"2026-09-25T05:51:01.012329Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c2c4883d556cb241d1e89610cda8a85e","sha1":"8dad40ddf7a3f5adb7044b56eacff24de76a30e8","sha256":"02fa1890eac5060c9a299adc0fa850f5e08484630cda3373e7bb7179637965b3","sha512":"e4183b727a2c16005ea5f38a21e9d8caac6af83d6a967461ccf0642febe50d1317801fed1fb8723fb12fdd3cd14ef16c7f404c8e5552b69c4174e01c926cdd87","ssdeep":"","tlshash":"c541281b4007f6411ee1ccf278ab976389c0cd725d342b509add9f2c82d0fa6776e822","size":2430,"data":"","first_seen":"2026-09-24T13:46:20.533083Z","last_seen":"2026-09-25T05:51:01.012875Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/framework-9b5d6ec4444c80fa.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f45f9a036208ef5b00302eaa0de99d4","sha1":"6271883ba52614a6412d4146f7b905cd75807c55","sha256":"1aee3a5f0c4b6735edff60d58f20a936ce11e5d4a36a5a76390aeda043ae4048","sha512":"e010606db08a71a7111170882ab6d6f807d6f13a49dda0d587fadcde6f7c2991993d2268792fbf1526c618188fb3024730ac893e41ead69646fe762ea234376c","ssdeep":"1536:KbCvuM7U0K2HEu+ZXnQ5Sw77nhZbqDNqGSMbXmbGWCufSTKSygJuR:KbCa2kucQwnSimHSTKSygMR","tlshash":"fdd309e97956f6536a7312ab00af1803727c6927780c8c70e240eed975bc479a17bf8d","size":141509,"data":"","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.420974Z","times_seen":176,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/webpack-bb469f829a664d48.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.172Z","timestamp":1790257526172,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/webpack-bb469f829a664d48.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"891-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=hnM.w1orSMG6MimPvZIfy5F33Y31xRwHq6ZExFGNc6I-1790257526.1756127-1.0.1.1-Pcjvt1UrLUGv5qEks8Ed7Cm7UClImLJpyNxzvMqTy_H00Moa7AzV5AV9aQL0z2x9oMObnCbCLkfAi.DWrbNJwqOxE2WovCuNFGbtiFbG6HC9fIvyIv_1K8EIk11hIj7c; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac29cc3b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"hnM.w1orSMG6MimPvZIfy5F33Y31xRwHq6ZExFGNc6I-1790257526.1756127-1.0.1.1-Pcjvt1UrLUGv5qEks8Ed7Cm7UClImLJpyNxzvMqTy_H00Moa7AzV5AV9aQL0z2x9oMObnCbCLkfAi.DWrbNJwqOxE2WovCuNFGbtiFbG6HC9fIvyIv_1K8EIk11hIj7c","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=hnM.w1orSMG6MimPvZIfy5F33Y31xRwHq6ZExFGNc6I-1790257526.1756127-1.0.1.1-Pcjvt1UrLUGv5qEks8Ed7Cm7UClImLJpyNxzvMqTy_H00Moa7AzV5AV9aQL0z2x9oMObnCbCLkfAi.DWrbNJwqOxE2WovCuNFGbtiFbG6HC9fIvyIv_1K8EIk11hIj7c; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":2193,"size_decoded":1906,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2193), with no line terminators","md5":"09985188723a77d0dc96533b3177fb30","sha1":"120be09a92353d98363349d3a6459a296e2bf760","sha256":"5dfe185409ff8cc0e73ea870cbefbcdac38297bbfa69c545686e536f7c51fa64","sha512":"a2d353fda78dd8e922c37d5a555a56af304c0b836da56290a8a453da2c1665c12e59e560de474509ae42bb5602f316488987c8f49ad1d079dcb77df10e287638","ssdeep":"","tlshash":"4b410bd931e6f4d6166b7a60013f481bf02b98f2f06ca4e49354c8f13d7029a9032f9e","first_seen":"2023-03-07T01:36:05Z","last_seen":"2026-09-25T08:32:44.42433Z","times_seen":18,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/_app-7e0dffbdb63082b7.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.178Z","timestamp":1790257526178,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/pages/_app-7e0dffbdb63082b7.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"82c8-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=WMP7lvnRb3FYlDrzlxAOYMVMzLuYvLQqoMEHhJoc0Ls-1790257526.1812103-1.0.1.1-2gS_loYb_Xd5fY7HjPXY2_YFqiPd2ihmcBy.auYWVd9diU.KimKApk9oJTxD3WIf2hfcL2OGFkEWNo8deIz05xxqaeFY7saV.moOE33uz2Ji.INqRSNnOJmfMXiVh3_a; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac29cceb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"WMP7lvnRb3FYlDrzlxAOYMVMzLuYvLQqoMEHhJoc0Ls-1790257526.1812103-1.0.1.1-2gS_loYb_Xd5fY7HjPXY2_YFqiPd2ihmcBy.auYWVd9diU.KimKApk9oJTxD3WIf2hfcL2OGFkEWNo8deIz05xxqaeFY7saV.moOE33uz2Ji.INqRSNnOJmfMXiVh3_a","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=WMP7lvnRb3FYlDrzlxAOYMVMzLuYvLQqoMEHhJoc0Ls-1790257526.1812103-1.0.1.1-2gS_loYb_Xd5fY7HjPXY2_YFqiPd2ihmcBy.auYWVd9diU.KimKApk9oJTxD3WIf2hfcL2OGFkEWNo8deIz05xxqaeFY7saV.moOE33uz2Ji.INqRSNnOJmfMXiVh3_a; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":33480,"size_decoded":13816,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (33480), with no line terminators","md5":"c03149fe6a8412303fb7fc7c49ed3e2e","sha1":"4ef2f25990a0733059b1fa7737e463ab6a51948c","sha256":"0a2f88b46163cbcc1031f9ba819d63b6218fd8bbaca360a3842fc10b003e0c9a","sha512":"a657e71cb6c519f7547268fd0d3271637c7183abfca074b9f7a6c95ac2affb2f9f289bf2f55147ee5ee4312e4defc740ad25e3a79e06d6a4237c3bb36361d101","ssdeep":"768:DJL0B04NXIyB/JhjLC0kg6mGtSMJCepPYagDSL5T+e:8nbhjV6mGtSePTgDSL5Se","tlshash":"dfe2f9dd72e2f10687a3e4a640af548bb97dac14b04c4cb6ea80d9d17a784bd4137f9c","first_seen":"2026-09-24T00:38:51.036296Z","last_seen":"2026-09-25T08:32:44.416772Z","times_seen":10,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/669-339d55ad45077513.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.181Z","timestamp":1790257526181,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/669-339d55ad45077513.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"af9a-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=yTgTBoamMYyjtvM2rZ1QJpdjFCJ5skdSR.a.Z85f1iw-1790257526.1834917-1.0.1.1-lOgVRicQ9ieKeUrv.SCDvgQw9SD3wApEUQIzE8w4PF4yYkLgWBLEDalo4Dm33RV0DVYkc3Ex6.bL9gebfa6HgUV6Jx0CcxIySegJqyslLUEqIndLzC8Q5ceXGcKzx3yb; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acd5b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"yTgTBoamMYyjtvM2rZ1QJpdjFCJ5skdSR.a.Z85f1iw-1790257526.1834917-1.0.1.1-lOgVRicQ9ieKeUrv.SCDvgQw9SD3wApEUQIzE8w4PF4yYkLgWBLEDalo4Dm33RV0DVYkc3Ex6.bL9gebfa6HgUV6Jx0CcxIySegJqyslLUEqIndLzC8Q5ceXGcKzx3yb","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=yTgTBoamMYyjtvM2rZ1QJpdjFCJ5skdSR.a.Z85f1iw-1790257526.1834917-1.0.1.1-lOgVRicQ9ieKeUrv.SCDvgQw9SD3wApEUQIzE8w4PF4yYkLgWBLEDalo4Dm33RV0DVYkc3Ex6.bL9gebfa6HgUV6Jx0CcxIySegJqyslLUEqIndLzC8Q5ceXGcKzx3yb; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44954,"size_decoded":15556,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (23341)","md5":"992799c812675e5cc284338be275216d","sha1":"383f2b719001689266adee39e140b27e57f76d7f","sha256":"2cae64aa1dc40773ef634f794abccec2b44f26ad61d811a8a969d535c6bb34d2","sha512":"a74ad61e9b091c0c098058a8838554f2c587fd17a8f40db2bc59f88f65235064eee02761d2f56b0083425b3e64cf4fcd9d1fc852e2c41045e619bdd416fb4a24","ssdeep":"768:hlbTUeh1RemrALFrjUgLk+VL0I4fJqTeA4Bd1XM6BNgW/9I46ZVtYVLuB:7wmXAxrjUglVL0HETeAsd1XM6BNqLYNQ","tlshash":"8813d685baa6b01283a331e1406f444ff179f939f49c5cb4b280e4e129b49ad857ff6c","first_seen":"2026-09-24T13:46:20.503913Z","last_seen":"2026-09-25T05:51:01.010661Z","times_seen":3,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/login-0e179d57d6b907b1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.189Z","timestamp":1790257526189,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/pages/login-0e179d57d6b907b1.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"49ae-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=qkhR4Dlf2gl2oVMYkPqdRYH9DHKqeBjO7f9bxV_g98w-1790257526.193241-1.0.1.1-L09zS.lQ_AbqIDVGpil3GKksky8W_1i9DqfZyJOWv5DI4oRJ.UBYbaZlEHQ.HEj1YGCcQtGASIj9tc489.Mg5Zmhob9Q48fEQgKtimaE34hrtZNFOPSR8VsReFJpA08Q; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2ace6b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"qkhR4Dlf2gl2oVMYkPqdRYH9DHKqeBjO7f9bxV_g98w-1790257526.193241-1.0.1.1-L09zS.lQ_AbqIDVGpil3GKksky8W_1i9DqfZyJOWv5DI4oRJ.UBYbaZlEHQ.HEj1YGCcQtGASIj9tc489.Mg5Zmhob9Q48fEQgKtimaE34hrtZNFOPSR8VsReFJpA08Q","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=qkhR4Dlf2gl2oVMYkPqdRYH9DHKqeBjO7f9bxV_g98w-1790257526.193241-1.0.1.1-L09zS.lQ_AbqIDVGpil3GKksky8W_1i9DqfZyJOWv5DI4oRJ.UBYbaZlEHQ.HEj1YGCcQtGASIj9tc489.Mg5Zmhob9Q48fEQgKtimaE34hrtZNFOPSR8VsReFJpA08Q; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":18862,"size_decoded":6481,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (18862), with no line terminators","md5":"c363f021fe994ec8fa1a29659ce67038","sha1":"ed733a96ade81252ed4de4c361b79f47bc8c9567","sha256":"a8689bba1069a6fe8fbe203c2b2a980dd5aa5f2544124aa47f126aa794084976","sha512":"dc230a9f534c61938d3c2130e86905b978eb28788f60bd2ca91b1d3f14db9a66d4ed8fc2e5021d803bf7a2914e73f4a074dde870777b0b318a110c476c8bccc3","ssdeep":"384:ks3sska04Wv0ZpZI4qOqvdAsZ197L7cRWXmqOqvdAsZ197L7cRWAOOZpN8NeBr36:ks3ssdb+0Z44qOqvdAsZ197L7cRWXmqF","tlshash":"9d82e941a7a8159df403cc8861ff710eb1ef712db1d58da4bbe2ac6928568c43537bc6","first_seen":"2026-09-24T00:38:51.012921Z","last_seen":"2026-09-25T08:32:44.423537Z","times_seen":10,"resource_available":true,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":107,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.374Z","timestamp":1790257526374,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"4c-49773873e8\"\r\nvary: Accept-Encoding\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=.aREEqP5gSp_bE4OFQ0QxdiC_7jQE7MzzHu7sZz0Ovo-1790257526.3770835-1.0.1.1-hapVOaA0QJl7pfKMD_JHVP_4yjZUyukSjBFR2RnsDBfdVrl.YCmzRC66O.UvFxqJ9JYymxHKx6GPY22Ca76DwoNI.nxFFbyQLkYRcs2_08pjzsm.rdPgvkOtHWZtDJ20; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncontent-encoding: br\r\ncf-ray: a4023ac3ded6b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":".aREEqP5gSp_bE4OFQ0QxdiC_7jQE7MzzHu7sZz0Ovo-1790257526.3770835-1.0.1.1-hapVOaA0QJl7pfKMD_JHVP_4yjZUyukSjBFR2RnsDBfdVrl.YCmzRC66O.UvFxqJ9JYymxHKx6GPY22Ca76DwoNI.nxFFbyQLkYRcs2_08pjzsm.rdPgvkOtHWZtDJ20","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=.aREEqP5gSp_bE4OFQ0QxdiC_7jQE7MzzHu7sZz0Ovo-1790257526.3770835-1.0.1.1-hapVOaA0QJl7pfKMD_JHVP_4yjZUyukSjBFR2RnsDBfdVrl.YCmzRC66O.UvFxqJ9JYymxHKx6GPY22Ca76DwoNI.nxFFbyQLkYRcs2_08pjzsm.rdPgvkOtHWZtDJ20; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":76,"size_decoded":876,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5352cb582146311d1540f6075d1f265e","sha1":"cbe5dad683f4f887122db6f6d343aa8ba41dee8b","sha256":"e182e3257a3b5564f7bfb9fb1c6a1e13f8f7c9a3fa0dd6e39ccf473ef8d4f960","sha512":"50b05ff9c7703a5997b538c02a177a32bc91ce03de33779039fe5f1eccb1d2b8f04735a24cad024999c0c937160d3fce66a9b1c114a5b8e95e8c11afcff59654","ssdeep":"","tlshash":"a4a001e0943cdc60aa63dd1c136413128fa05122651d28938afd3044c0301510300d90","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.425501Z","times_seen":667,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/139-88233707e5e1051f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.185Z","timestamp":1790257526185,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/139-88233707e5e1051f.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1b4d-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=L5URIRVG_sIk740_fd93gzuRoS.jegdtVE1V7VtGKBs-1790257526.189609-1.0.1.1-R3GQPVOHOsZNB5NAooYXLQwin5nMmZBeSWlt0TpE8rfh5zbOu1I1eDq3pzmkWJycNZ2fRlYvJ2eQO.SIOriffcpV8wNGMr2kdxBYckRdYmn39ZVCMqlrFgb6_APUIf5u; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acdab4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"L5URIRVG_sIk740_fd93gzuRoS.jegdtVE1V7VtGKBs-1790257526.189609-1.0.1.1-R3GQPVOHOsZNB5NAooYXLQwin5nMmZBeSWlt0TpE8rfh5zbOu1I1eDq3pzmkWJycNZ2fRlYvJ2eQO.SIOriffcpV8wNGMr2kdxBYckRdYmn39ZVCMqlrFgb6_APUIf5u","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=L5URIRVG_sIk740_fd93gzuRoS.jegdtVE1V7VtGKBs-1790257526.189609-1.0.1.1-R3GQPVOHOsZNB5NAooYXLQwin5nMmZBeSWlt0TpE8rfh5zbOu1I1eDq3pzmkWJycNZ2fRlYvJ2eQO.SIOriffcpV8wNGMr2kdxBYckRdYmn39ZVCMqlrFgb6_APUIf5u; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":6989,"size_decoded":3340,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6987), with no line terminators","md5":"40019529f08d66073ce8fd2b82fa8986","sha1":"dd6e83bcc6bac32b645da9210883fb1edc0c22b5","sha256":"edfba3685111667e6f265d8624bab1c4ad9a454e96f453409f241900d69f9182","sha512":"855705c22da55697d3b114d134fe9d65eae2371ed00047945c2d1cd54379c401276816b31ee9c0d21abafe3decb0376f32a1e3f7ab97f7f082e9a558c8541363","ssdeep":"192:XHJuUu3y/HVvYswWyVoDRZv2U7vb1ZsG0:XHIJ3iumyVoDRRT7vb1ZsG0","tlshash":"d2e1d998d9d57c6ffe2f518acacf4c22f30da820b71d48a5f1b29685115c14813a3bee","first_seen":"2026-09-24T13:46:20.522851Z","last_seen":"2026-09-25T05:51:01.011778Z","times_seen":3,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/785-194388d0a8adb6a6.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.186Z","timestamp":1790257526186,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/785-194388d0a8adb6a6.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1381a-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=9vDJ0usk3vSyjpcADa9XIa0ImSelMvW1IJcSrrYIPXg-1790257526.1890702-1.0.1.1-cFYEToBK3K9y2aXZ843g6WUJyz5t6w_nt7k_m7rw5YzAcSojYhd3ZettGnZDIcnwDMZ710ltu3MrRyQqK5zzU3u5obJdWXbnFw.rRdwWCFu0fw9A.JnMfHwbbl6LgKml; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acdcb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"9vDJ0usk3vSyjpcADa9XIa0ImSelMvW1IJcSrrYIPXg-1790257526.1890702-1.0.1.1-cFYEToBK3K9y2aXZ843g6WUJyz5t6w_nt7k_m7rw5YzAcSojYhd3ZettGnZDIcnwDMZ710ltu3MrRyQqK5zzU3u5obJdWXbnFw.rRdwWCFu0fw9A.JnMfHwbbl6LgKml","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=9vDJ0usk3vSyjpcADa9XIa0ImSelMvW1IJcSrrYIPXg-1790257526.1890702-1.0.1.1-cFYEToBK3K9y2aXZ843g6WUJyz5t6w_nt7k_m7rw5YzAcSojYhd3ZettGnZDIcnwDMZ710ltu3MrRyQqK5zzU3u5obJdWXbnFw.rRdwWCFu0fw9A.JnMfHwbbl6LgKml; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":79898,"size_decoded":27356,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (39786)","md5":"f0b132b999b0e4c981df1a6011b1ff04","sha1":"c5ef57811be8018fc738e67f81eff24bc08b2ce1","sha256":"b548ced5d5c606131cb8d49dfefc13b58d6a199229365e5b8964ebb1e4d584a5","sha512":"493824644a07215243494eb76e38848dbef0eec8ad8ed4313c44970ead83c2d40762761d93f8ed67b7d35552dc5701c084854a55f4262d0dcc2888bd333b6c61","ssdeep":"1536:YoFItVhwfdoXHb0juA2ugi+K4RJksHEY/WM859rMbHXKMbxhoVbFxbR:4hFA29icRJksHE2LWyXRhO","tlshash":"1e73d6c4b793b456837a78a4402f400bf27a9db9f04ccc98f2a5d5d2797866d906af3c","first_seen":"2026-09-24T00:38:51.020899Z","last_seen":"2026-09-25T08:32:44.427394Z","times_seen":10,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/540-a68c3ead76933934.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.187Z","timestamp":1790257526187,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/540-a68c3ead76933934.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"3a46-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=29gm8Hx0CriovDWWG3VuCWL_SeyAdUVgGXQehn702vc-1790257526.1898448-1.0.1.1-Y9B0GvZInFsea3R6L.8V_7J8ldP8xB8sjbr4mkZMJ1inub2whe2clAEN2AtwQva3jXjJSeJngWlh3IO1c7ok.2HK7IzztN87bGFJ25POPnoGFJBVLW2yq8r6I19aHZx1; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acdfb4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"29gm8Hx0CriovDWWG3VuCWL_SeyAdUVgGXQehn702vc-1790257526.1898448-1.0.1.1-Y9B0GvZInFsea3R6L.8V_7J8ldP8xB8sjbr4mkZMJ1inub2whe2clAEN2AtwQva3jXjJSeJngWlh3IO1c7ok.2HK7IzztN87bGFJ25POPnoGFJBVLW2yq8r6I19aHZx1","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=29gm8Hx0CriovDWWG3VuCWL_SeyAdUVgGXQehn702vc-1790257526.1898448-1.0.1.1-Y9B0GvZInFsea3R6L.8V_7J8ldP8xB8sjbr4mkZMJ1inub2whe2clAEN2AtwQva3jXjJSeJngWlh3IO1c7ok.2HK7IzztN87bGFJ25POPnoGFJBVLW2yq8r6I19aHZx1; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14918,"size_decoded":5975,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (14918), with no line terminators","md5":"31af69e34680f9c8244cc621b9d54d6c","sha1":"af2f86fe9f8ece104f9defc90b0f713c591a6994","sha256":"7c6e8a8d7d4d404770030f9a7a917fd0ab1392fe71b68f32f7f96972d0bf05fe","sha512":"c5fbaa69db3d24626a8f171685449f11cf4e0b764d507356d75aff2bc04e41715e55bd8af0282bc2381d339872d65c35697828a6f299eaf84504095912bf5dc2","ssdeep":"192:F+x+6Wu80ovRhTvFa7XYa267UKskmhM9r4Uz70rk1NnGOOAvCP3:UxEu8pvRhTvsca267UVjM9rxAI1NbLC/","tlshash":"b462e7bcebc0b8264d7bc1cdd6ef481ae66ca061a70918b5f0970d40279d2dd1627fac","first_seen":"2026-09-24T13:46:20.525194Z","last_seen":"2026-09-25T05:51:01.012329Z","times_seen":3,"resource_available":true,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/framework-9b5d6ec4444c80fa.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.173Z","timestamp":1790257526173,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/framework-9b5d6ec4444c80fa.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"228c5-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=GYfSQO03HbEvKzxqIhj2GBXh7h2HmRjv6nyoB_cCgRE-1790257526.1765027-1.0.1.1-Tlgjtm_WQL5gUC55_u1MEXJMSJbmPWDOTnDyaiDILTt42x1m7zPNEsVvt7xfUl0xI8fXR63mwVUWzoKK_IBKLigRG6x6UZdZ2lk6R0DeoQ2ztLBvFSEnVRBz0CPDt1QE; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac29cc7b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"GYfSQO03HbEvKzxqIhj2GBXh7h2HmRjv6nyoB_cCgRE-1790257526.1765027-1.0.1.1-Tlgjtm_WQL5gUC55_u1MEXJMSJbmPWDOTnDyaiDILTt42x1m7zPNEsVvt7xfUl0xI8fXR63mwVUWzoKK_IBKLigRG6x6UZdZ2lk6R0DeoQ2ztLBvFSEnVRBz0CPDt1QE","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=GYfSQO03HbEvKzxqIhj2GBXh7h2HmRjv6nyoB_cCgRE-1790257526.1765027-1.0.1.1-Tlgjtm_WQL5gUC55_u1MEXJMSJbmPWDOTnDyaiDILTt42x1m7zPNEsVvt7xfUl0xI8fXR63mwVUWzoKK_IBKLigRG6x6UZdZ2lk6R0DeoQ2ztLBvFSEnVRBz0CPDt1QE; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":141509,"size_decoded":46719,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65154)","md5":"4f45f9a036208ef5b00302eaa0de99d4","sha1":"6271883ba52614a6412d4146f7b905cd75807c55","sha256":"1aee3a5f0c4b6735edff60d58f20a936ce11e5d4a36a5a76390aeda043ae4048","sha512":"e010606db08a71a7111170882ab6d6f807d6f13a49dda0d587fadcde6f7c2991993d2268792fbf1526c618188fb3024730ac893e41ead69646fe762ea234376c","ssdeep":"1536:KbCvuM7U0K2HEu+ZXnQ5Sw77nhZbqDNqGSMbXmbGWCufSTKSygJuR:KbCa2kucQwnSimHSTKSygMR","tlshash":"fdd309e97956f6536a7312ab00af1803727c6927780c8c70e240eed975bc479a17bf8d","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.420974Z","times_seen":176,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/643-49ffaa237a345b9d.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.188Z","timestamp":1790257526188,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/643-49ffaa237a345b9d.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"3cc2-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=a8GJZPCbqYIF.E75b4HaVu8szUJyMpvSUVWeCULHl2c-1790257526.1914732-1.0.1.1-nEtRpQIubHhKPcXUzqUQ5VZIcbshJHm9juI3OWXg87LVXrqzw5ZFg8cz753dKd6zVaNwPpaLxPcUFz7B51bDYYZfzKr_sh1NkOmE_N4161WdO6t7VBEGaePaN7hnSxzL; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2ace2b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"a8GJZPCbqYIF.E75b4HaVu8szUJyMpvSUVWeCULHl2c-1790257526.1914732-1.0.1.1-nEtRpQIubHhKPcXUzqUQ5VZIcbshJHm9juI3OWXg87LVXrqzw5ZFg8cz753dKd6zVaNwPpaLxPcUFz7B51bDYYZfzKr_sh1NkOmE_N4161WdO6t7VBEGaePaN7hnSxzL","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=a8GJZPCbqYIF.E75b4HaVu8szUJyMpvSUVWeCULHl2c-1790257526.1914732-1.0.1.1-nEtRpQIubHhKPcXUzqUQ5VZIcbshJHm9juI3OWXg87LVXrqzw5ZFg8cz753dKd6zVaNwPpaLxPcUFz7B51bDYYZfzKr_sh1NkOmE_N4161WdO6t7VBEGaePaN7hnSxzL; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15554,"size_decoded":6555,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (15554), with no line terminators","md5":"c355a95e04afe3e1b32dbfd458038360","sha1":"d9f67375b6d52d4060e1fe44d887f77af88744dd","sha256":"3d431fcd761bfbdc9592b3f636c8929ad8aa39ab7475122ce156158a1706dff9","sha512":"96d2f57994ac01f49f18ea87e77a9a73979a3b0553e6273fd4681ca0f275d54ced1c3ee077bd408aea90c3090c47aa7516cfe5aff141dcd46694ee0a3bb3acc5","ssdeep":"192:matg+LsetFyOo6iAhTMFSmeDogQlPmm6znQCUT4CR+EsCGSFBVHkgK40:/gHfBFS57ePmm6znBUTvQE3GSRHr0","tlshash":"4362f91aa3d8275e7906c7a4307ba50fb2cf207f72b4cb65e211fa3675118e4146abc7","first_seen":"2026-09-24T00:38:51.011382Z","last_seen":"2026-09-25T08:32:44.422905Z","times_seen":10,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.432Z","timestamp":1790257526432,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22424\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5798\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:26 GMT\r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22424,"size_decoded":22764,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-09-25T08:32:44.415372Z","times_seen":1649,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":25,"connect":1,"send":0,"wait":6,"receive":0,"ssl":19},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.437Z","timestamp":1790257526437,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargoserif-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 26708\r\nlast-modified: Mon, 11 Mar 2019 20:52:01 GMT\r\netag: \"5c86ca71-6854\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:26 GMT\r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26708,"size_decoded":27048,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26708, version 1.13107","md5":"885d42ab7ffcffc42ed29816c3ce9727","sha1":"3d84cb41ddfb5bf8627e2b9dc867237bea47baad","sha256":"aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310","sha512":"1b64ea9a7598a69dc5837f70af7eb702171fb55dfc58aa071a5efe70522676da4cbc1d3af054ab3b8f325143479d484388917e015e9ab61b5b7322077461fb11","ssdeep":"768:NqcUCwKb4mdzrl3vUSwXTRoji0iG6dlLsCPlT:NqrCwkTlLwV0izRPZ","tlshash":"c4c2e2c8099724dedb6d81eea692155e3f01c2df861a009a419ecc4c0c9dcdc9b9337e","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-09-25T08:32:44.418724Z","times_seen":276,"resource_available":false,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":21,"connect":1,"send":0,"wait":5,"receive":1,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/favicon.ico","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.652Z","timestamp":1790257526652,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: image/x-icon\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"47e-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\ncf-cache-status: BYPASS\r\nset-cookie: __cf_bm=x9TjU.JZp2VPUMSWYAodbKVU1k4gwrGQwvdnsKfJs4o-1790257526.655177-1.0.1.1-6VExHHaUelbV2IqOVPepeB9IOLB_IZ5DQNhesASXoMbZ_7iyoWiSxr7qxBdwaV.KLROsJzmjQmOazTEikJ1_kdsM_SgV6VAOCm1oifVyxAr3aVsIN__HaRQ_GaOAUt4z; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac59905b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"x9TjU.JZp2VPUMSWYAodbKVU1k4gwrGQwvdnsKfJs4o-1790257526.655177-1.0.1.1-6VExHHaUelbV2IqOVPepeB9IOLB_IZ5DQNhesASXoMbZ_7iyoWiSxr7qxBdwaV.KLROsJzmjQmOazTEikJ1_kdsM_SgV6VAOCm1oifVyxAr3aVsIN__HaRQ_GaOAUt4z","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=x9TjU.JZp2VPUMSWYAodbKVU1k4gwrGQwvdnsKfJs4o-1790257526.655177-1.0.1.1-6VExHHaUelbV2IqOVPepeB9IOLB_IZ5DQNhesASXoMbZ_7iyoWiSxr7qxBdwaV.KLROsJzmjQmOazTEikJ1_kdsM_SgV6VAOCm1oifVyxAr3aVsIN__HaRQ_GaOAUt4z; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":1150,"size_decoded":1322,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"11e6b612207abf064158e69540c16e24","sha1":"9e3912485514553b2e17b578c8340986f1172b4d","sha256":"8670da3c95c03b59b091eac882b67e0b59b765c455b8d871abd2e55d4618573b","sha512":"2a1257c597a985ae9da8a029a2bab00e2cda2106026578ac382c7319f4754d42c47e51f59a3f45f1228e4e036b00707a9b087d6dbf18821327f187e4e79ea24f","ssdeep":"","tlshash":"93214200430423acdcabd273f6027b69044f2d2ed9c5613f634038d5a4aff7608e3648","first_seen":"2023-05-08T02:46:24Z","last_seen":"2026-09-25T08:32:44.426693Z","times_seen":860,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/css/ec70bd28c3629d55.css","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.171Z","timestamp":1790257526171,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/css/ec70bd28c3629d55.css HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: text/css; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"23bd-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=0,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=nb8eav7Rngloc.IPSK76E7X1SOb_v.CbIZgg8xaZF68-1790257526.173967-1.0.1.1-yevdSQaJiK_HddaF.QVklyEwq2VkjQemCRrGtAnfs9ef7oJ13zreq.pJD9Fx7t2DWssOrazTbqc1lyKO9.r01N1pq9I.gwgd4QOp6f8bY1ucAqkAwb01hbaGP.CVrZwl; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac29cc1b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"nb8eav7Rngloc.IPSK76E7X1SOb_v.CbIZgg8xaZF68-1790257526.173967-1.0.1.1-yevdSQaJiK_HddaF.QVklyEwq2VkjQemCRrGtAnfs9ef7oJ13zreq.pJD9Fx7t2DWssOrazTbqc1lyKO9.r01N1pq9I.gwgd4QOp6f8bY1ucAqkAwb01hbaGP.CVrZwl","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=nb8eav7Rngloc.IPSK76E7X1SOb_v.CbIZgg8xaZF68-1790257526.173967-1.0.1.1-yevdSQaJiK_HddaF.QVklyEwq2VkjQemCRrGtAnfs9ef7oJ13zreq.pJD9Fx7t2DWssOrazTbqc1lyKO9.r01N1pq9I.gwgd4QOp6f8bY1ucAqkAwb01hbaGP.CVrZwl; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9149,"size_decoded":1826,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (9149), with no line terminators","md5":"ec0b8850fd294a499a073697700451dd","sha1":"ff2a49e971352b1ab3c13b93cb843e3f1034672a","sha256":"b4d49ad903ce6450f2f54efba11e4f2c7f5a6148acc0c2bd40e0d7f853f118f8","sha512":"40e211e8743dd99a7284e137ea56cfb3b9b023134faf9385277844ddcb5386ecf2198a974cb9f9ef63343c29d4d24e10a220f1d7f3315c5d61d109f6a5a5929b","ssdeep":"192:2VZvPsbGQNaUeb3K79C3URJK9Rvg762tpDd6LEAq:/b","tlshash":"c012bbb24a0662d28d23cd83f5db75115c1f601eb4850897e37e5eaa1df342a46e0f7e","first_seen":"2026-09-24T00:38:51.030157Z","last_seen":"2026-09-25T08:32:44.420433Z","times_seen":10,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/main-3123a443c688934f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.174Z","timestamp":1790257526174,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/main-3123a443c688934f.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"199f6-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=cG26k0C56ib6h9Ws8niQelXJ4lg_A4oX7eYHtaOvvTw-1790257526.1777-1.0.1.1-EgajTDI69fHC3I.yi3p_giNF9Felnntesu.0vEJhS1qBgawz4xASYOFGqeZFo460bOMU4Xp.DDt7ARtYWR9dbJAg1s_cNQnYbnm9SWlbQtQ3gQEoQ.iym_FPQtJRUFnd; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac29cc8b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"cG26k0C56ib6h9Ws8niQelXJ4lg_A4oX7eYHtaOvvTw-1790257526.1777-1.0.1.1-EgajTDI69fHC3I.yi3p_giNF9Felnntesu.0vEJhS1qBgawz4xASYOFGqeZFo460bOMU4Xp.DDt7ARtYWR9dbJAg1s_cNQnYbnm9SWlbQtQ3gQEoQ.iym_FPQtJRUFnd","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=cG26k0C56ib6h9Ws8niQelXJ4lg_A4oX7eYHtaOvvTw-1790257526.1777-1.0.1.1-EgajTDI69fHC3I.yi3p_giNF9Felnntesu.0vEJhS1qBgawz4xASYOFGqeZFo460bOMU4Xp.DDt7ARtYWR9dbJAg1s_cNQnYbnm9SWlbQtQ3gQEoQ.iym_FPQtJRUFnd; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":104950,"size_decoded":31870,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5c8fa4faef8700c12dd2c8fe8b29ee96","sha1":"6882f5b250869c46d913875d48ae03c2b9be449d","sha256":"0eed4542b90a01be928023ec3dc7abed45c63ffc8067a496863ecef579d4af9f","sha512":"14f7aa71733af380b5ba661183daf80f68895e6c02908fd09f788407a93a092ae2f040071d6d8748c1072726d3071d6f68f815a2f8d415292b1f5f8f6bd87b8e","ssdeep":"1536:zkF5kayDDfhPDrwJw4lwON7npFW9TR2pS9w:nayIBrnhpS9w","tlshash":"d4a3e7a871e2f882459266b1803f100bf27a5c7af05dac91a39eccd17e74d4ea173f59","first_seen":"2023-03-07T16:53:51Z","last_seen":"2026-09-25T08:32:44.413062Z","times_seen":33,"resource_available":true,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/217-fc4ca4bc23c5eb89.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.180Z","timestamp":1790257526180,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/217-fc4ca4bc23c5eb89.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"33ed-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=Gq3OHHgdSNjQSC8diUVFqvClwt21fd5JarVTXYcWAJU-1790257526.1827347-1.0.1.1-5TxXZsLp5PeTcNz3_4GK.oDR2CX3JHNm2IdsrDUqWCmV6oPy8R1_YVI_46mEPQrwRwMI3Dk48Ov7bQCHB_BQdvKCmIOXHRjK.nAGKMo8_cIGgu5NS1NyNr0EL1LGybsA; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acd2b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"Gq3OHHgdSNjQSC8diUVFqvClwt21fd5JarVTXYcWAJU-1790257526.1827347-1.0.1.1-5TxXZsLp5PeTcNz3_4GK.oDR2CX3JHNm2IdsrDUqWCmV6oPy8R1_YVI_46mEPQrwRwMI3Dk48Ov7bQCHB_BQdvKCmIOXHRjK.nAGKMo8_cIGgu5NS1NyNr0EL1LGybsA","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=Gq3OHHgdSNjQSC8diUVFqvClwt21fd5JarVTXYcWAJU-1790257526.1827347-1.0.1.1-5TxXZsLp5PeTcNz3_4GK.oDR2CX3JHNm2IdsrDUqWCmV6oPy8R1_YVI_46mEPQrwRwMI3Dk48Ov7bQCHB_BQdvKCmIOXHRjK.nAGKMo8_cIGgu5NS1NyNr0EL1LGybsA; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":13293,"size_decoded":6524,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10017)","md5":"c9ac5e786f88fe4efe5a54e23a7786ad","sha1":"14418486bbd22b01ed8d6e93b87ee08e71f34155","sha256":"1f6db8541d75dcacbef78c15894ebc5f8e5d184fb74527ce5a98d8e6a9ec3cd8","sha512":"6d6c14e26caa4bcaefe03d01135a6df9fc5f114e5d5c01edbfdb81eefdc2bffa7bb3b5eca48cc5241193abfddc47ecadb72d0764956b47a182aa8d78841db737","ssdeep":"192:0fCqtsk9qPVGKipX8v89xkvhRMoqlDfqTdba1cKVNNqwoB+K7nxD120Yi6yvn/rw:WptSOXQkuhGoqlDfiQBIX6yvzqPc8","tlshash":"4752f8a8b041b8715a9771e280bf080fb13824a531094ca5f7e6fdd85ef86a84127f9e","first_seen":"2026-09-24T00:38:51.037789Z","last_seen":"2026-09-25T08:32:44.421505Z","times_seen":10,"resource_available":true,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":65,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/463-d1ffc92465982ad1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.182Z","timestamp":1790257526182,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/463-d1ffc92465982ad1.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"c658-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=WZ1GW0V83ikSMSvsfXPNkw9O1wVxSLu5VyRn6LPkzEg-1790257526.184967-1.0.1.1-ldEnJBbFY9Jmb9S5NWmnWjPcISlIb0N9_6.u5CQH0b9d50meBePg5E6oCNhAeYd8LY8GX02w1l2lWGb7zHwsJoxHbyij1UEj_4uSs8TFfn3lYmQmCD8VVq12DowQDvqq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acd6b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"WZ1GW0V83ikSMSvsfXPNkw9O1wVxSLu5VyRn6LPkzEg-1790257526.184967-1.0.1.1-ldEnJBbFY9Jmb9S5NWmnWjPcISlIb0N9_6.u5CQH0b9d50meBePg5E6oCNhAeYd8LY8GX02w1l2lWGb7zHwsJoxHbyij1UEj_4uSs8TFfn3lYmQmCD8VVq12DowQDvqq","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=WZ1GW0V83ikSMSvsfXPNkw9O1wVxSLu5VyRn6LPkzEg-1790257526.184967-1.0.1.1-ldEnJBbFY9Jmb9S5NWmnWjPcISlIb0N9_6.u5CQH0b9d50meBePg5E6oCNhAeYd8LY8GX02w1l2lWGb7zHwsJoxHbyij1UEj_4uSs8TFfn3lYmQmCD8VVq12DowQDvqq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":50776,"size_decoded":16807,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (28458)","md5":"11bf3cd819d9c431721fc48f555fe313","sha1":"c5a1d854ffd15e725157340d55a8930ce527f24c","sha256":"179e5f9b4c0a9481d03deffae6657f5bbed8e09c4ce0111283818378bfa14ab6","sha512":"c3dc4cd13a780b67bdc2b312d026256a64f6b8c58c2d601822c32362be87079cf2c7aebeac979627f9afb07babb936a9c880250a7f9c9f948a06acc9027e815f","ssdeep":"768:ubJa80WZHgVN4Dx5jrqXFqvFnkdgJQQ+WMc5ZnSHX:u9a80WZHgVNWx5jr6qv5kdgJcqZS3","tlshash":"50332ca8f6c1f923a56340d8d1ef442bb7a9b561f70e0c54f177c8c92ba809c5262f9d","first_seen":"2026-09-24T13:46:20.530935Z","last_seen":"2026-09-25T05:51:01.011243Z","times_seen":3,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/995-23d4606ec37e3134.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.184Z","timestamp":1790257526184,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/995-23d4606ec37e3134.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1df4-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=gXeWRBcA7BpvimcTRMpELBjgsO7N1cZdZwhBiNmFan8-1790257526.185853-1.0.1.1-3x2hnHSTJZhB_2vbBFrYDivBDKDlZjKWKDIksp51TxnvsOQMR43loDYSADsIa3B_5sipcdQ4NnzN7bBJ3NTZM1iYX6Am4UpBmDFxzOKPUyib7_ZaKVz65HKKbgKoQ2.s; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac2acd8b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"gXeWRBcA7BpvimcTRMpELBjgsO7N1cZdZwhBiNmFan8-1790257526.185853-1.0.1.1-3x2hnHSTJZhB_2vbBFrYDivBDKDlZjKWKDIksp51TxnvsOQMR43loDYSADsIa3B_5sipcdQ4NnzN7bBJ3NTZM1iYX6Am4UpBmDFxzOKPUyib7_ZaKVz65HKKbgKoQ2.s","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=gXeWRBcA7BpvimcTRMpELBjgsO7N1cZdZwhBiNmFan8-1790257526.185853-1.0.1.1-3x2hnHSTJZhB_2vbBFrYDivBDKDlZjKWKDIksp51TxnvsOQMR43loDYSADsIa3B_5sipcdQ4NnzN7bBJ3NTZM1iYX6Am4UpBmDFxzOKPUyib7_ZaKVz65HKKbgKoQ2.s; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":7668,"size_decoded":3340,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7668), with no line terminators","md5":"fb29b5fa3b79aeeceedeb1d67ca017d5","sha1":"05de4faacdf95679f780ee00c0b1ca1d3a65e1cb","sha256":"b7e6d113c49c58b4e723329668f1adaa699eed95036a88f9c25f4db71461b8a3","sha512":"455bf398b623a7d3d07ca6e9451498529e9b570a5421a72cd6ad4bc1da9149eaf25e19577cee5cee7c4e657b80e4e78d5d55c4d213f8fcb8cd9cfe2a1a717ae1","ssdeep":"192:/xH+milOAulOgFcVlbiZl1fZDLPxXidmdnul4m7e0:krgYiZl1fZDLPxXiEnulLN","tlshash":"11f1a4a4fb80f670b96f85cc6def08d5ef7425109b5c1cbaf8a65049025f2c58463e8e","first_seen":"2026-09-24T13:46:20.531866Z","last_seen":"2026-09-25T05:51:01.006975Z","times_seen":3,"resource_available":true,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.372Z","timestamp":1790257526372,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"97e-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=AG3gZK4nsmIoEqMLn7mARecZzVKksS8ICYZPdjcmuz0-1790257526.3771331-1.0.1.1-SQGKXtSxXnxqEI8VECWKI8eSFvH5K3FRpW4PHS5Mkt0Gq2zsM5L.zys_x9iYh.cWDWYVRR3Zv0QZRxbtwxqE0Js9YHwPNMlkgk_pbwqbTbHiZEoX6Ch1QMZ.7TeP_HCs; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT\r\ncf-ray: a4023ac3ded1b4f3-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"AG3gZK4nsmIoEqMLn7mARecZzVKksS8ICYZPdjcmuz0-1790257526.3771331-1.0.1.1-SQGKXtSxXnxqEI8VECWKI8eSFvH5K3FRpW4PHS5Mkt0Gq2zsM5L.zys_x9iYh.cWDWYVRR3Zv0QZRxbtwxqE0Js9YHwPNMlkgk_pbwqbTbHiZEoX6Ch1QMZ.7TeP_HCs","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:26Z","raw_expires":"Thu, 24 Sep 2026 14:15:26 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=AG3gZK4nsmIoEqMLn7mARecZzVKksS8ICYZPdjcmuz0-1790257526.3771331-1.0.1.1-SQGKXtSxXnxqEI8VECWKI8eSFvH5K3FRpW4PHS5Mkt0Gq2zsM5L.zys_x9iYh.cWDWYVRR3Zv0QZRxbtwxqE0Js9YHwPNMlkgk_pbwqbTbHiZEoX6Ch1QMZ.7TeP_HCs; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:26 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":2430,"size_decoded":1705,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (2430), with no line terminators","md5":"c2c4883d556cb241d1e89610cda8a85e","sha1":"8dad40ddf7a3f5adb7044b56eacff24de76a30e8","sha256":"02fa1890eac5060c9a299adc0fa850f5e08484630cda3373e7bb7179637965b3","sha512":"e4183b727a2c16005ea5f38a21e9d8caac6af83d6a967461ccf0642febe50d1317801fed1fb8723fb12fdd3cd14ef16c7f404c8e5552b69c4174e01c926cdd87","ssdeep":"","tlshash":"c541281b4007f6411ee1ccf278ab976389c0cd725d342b509add9f2c82d0fa6776e822","first_seen":"2026-09-24T13:46:20.533083Z","last_seen":"2026-09-25T05:51:01.012875Z","times_seen":3,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www10.wellsfargomedia.com/auth/static/images/COB-BOB-IRT-enroll_tractor.jpg","fqdn":"www10.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"23.52.23.95","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.410Z","timestamp":1790257526410,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www10.wellsfargomedia.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 07 Oct 2025 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:51:72:B8:FA:94:2B:FE:9F:B4:1F:BC:6B:6F:0E:D8:D1:1C:2A:63","sha256":"DF:16:89:32:0F:23:BD:46:7A:ED:B4:28:DB:28:F3:A2:7E:BF:A7:CA:C1:56:AF:96:23:16:D2:D5:07:D7:69:A2"}}},"request":{"raw":"GET /auth/static/images/COB-BOB-IRT-enroll_tractor.jpg HTTP/1.1\r\nHost: www10.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-methods: POST\r\nlast-modified: Mon, 10 Aug 2026 05:38:27 GMT\r\nx-frame-options: SAMEORIGIN\r\netag: \"6a75d2e8-95bb8\"\r\ncontent-security-policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp\r\nserver: Akamai Image Manager\r\ncontent-length: 507666\r\ncontent-type: image/avif\r\ncache-control: private, no-transform, max-age=2592000\r\nexpires: Sat, 24 Oct 2026 13:45:26 GMT\r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":507666,"size_decoded":508227,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"a8dfffcb87726ac8bc9ca4025839d41a","sha1":"eb1b20c10b0026dfd5d9f9c9ab56f1a82c3c6135","sha256":"5dace8618159bbaee39b802658dc20e8a6391e892453a3edbeadf5e7cd14091d","sha512":"d74e1e8ecae0c46485eee52a17e918abe5eeb221877bac724fadf7331298afa08b865e0ef083fc7d892bb0725768fc847db806db682bd09d69b9531b48e98ed0","ssdeep":"12288:QmJWnYDtrwdtw7HOCPkNK6LGANMVb6x5dxw2HpbSWlZET4wTIT:ZWnYhrEwgXNMRIdxjSWYtu","tlshash":"6fb423841f22796cb9ee190b3151cd98f44ebacb2ee89d3c60d624de30727191fe6457","first_seen":"2026-08-14T00:27:47.337395Z","last_seen":"2026-09-25T08:32:44.416042Z","times_seen":9,"resource_available":false,"data":null}},"time_used":348,"timings":{"blocked":-1,"dns":18,"connect":21,"send":0,"wait":179,"receive":100,"ssl":30},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:26.438Z","timestamp":1790257526438,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-sbd.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22600\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5848\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:26 GMT\r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22600,"size_decoded":22940,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107","md5":"83df8749c013f13019fa8e0912041759","sha1":"2bbffcf012a59e47661c0a37edda0fc772992ae7","sha256":"ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba","sha512":"60ef81e9500e9b33e9d799d4bd56f8ef4df5dfdc88a42d5739c3da65733cfaedd42aa0dc623d46b370dc750c693cbe0c473c92e6c4c2a7bed2c7da33b8bcee84","ssdeep":"384:X4TnfMKBnolaid+tMKsLZqy+1EooqFdf8THOgmFtI2ErNX0sAZwk+pcHgXvCdFPh:XWXBolb+tMKoc1E1qFdgHOujisY+pcHt","tlshash":"5ba2d0f0681f37b4473b083c3472a3ca80f69516eaea19951b3d123e699ada5934c37d","first_seen":"2023-04-13T05:35:56Z","last_seen":"2026-09-25T08:32:44.426085Z","times_seen":1478,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":20,"connect":1,"send":0,"wait":6,"receive":1,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-24T13:45:25.746Z","timestamp":1790257525746,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 24 Sep 2026 13:45:26 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-powered-by: Next.js\r\nvary: Accept-Encoding\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\ncache-control: private\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\nset-cookie: __cf_bm=3G.ByeWRRk0xPxjazPuAlfXCXnzDuzt67Ti3DjlJ8B0-1790257525.769395-1.0.1.1-_SRWpNUxf.VAAx5mEaAAYoja_CvSG0Dy0vUyJZTFej5jsfC8FA4noDw2alMNytVF13HEqGKx16nsnSHNYgPD7_rWwVvpZh6M_VnJvsfy.8jETVUJdyHAJCecuArPKbqE; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:25 GMT\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a4023ac009e00883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"3G.ByeWRRk0xPxjazPuAlfXCXnzDuzt67Ti3DjlJ8B0-1790257525.769395-1.0.1.1-_SRWpNUxf.VAAx5mEaAAYoja_CvSG0Dy0vUyJZTFej5jsfC8FA4noDw2alMNytVF13HEqGKx16nsnSHNYgPD7_rWwVvpZh6M_VnJvsfy.8jETVUJdyHAJCecuArPKbqE","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:25Z","raw_expires":"Thu, 24 Sep 2026 14:15:25 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=3G.ByeWRRk0xPxjazPuAlfXCXnzDuzt67Ti3DjlJ8B0-1790257525.769395-1.0.1.1-_SRWpNUxf.VAAx5mEaAAYoja_CvSG0Dy0vUyJZTFej5jsfC8FA4noDw2alMNytVF13HEqGKx16nsnSHNYgPD7_rWwVvpZh6M_VnJvsfy.8jETVUJdyHAJCecuArPKbqE; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:25 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}],"data":{"size":76075,"size_decoded":12560,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"cfec065d235804fcc2fb59948dc566f7","sha1":"069fad0bf5183a594f62d9b1b1569d834c120984","sha256":"32fbade2a7a52bc2644db4c80423acbb11f1e20bbe80cf3d64d245c2a1ae327c","sha512":"e1f2f2c0221c9b8835d21b0b23df17c47a1807973c5f42e5f711a2db49e2ae8c5055f45b4ef3bfbbd57aaccf8b27a7d6e2284ba05ec78b0d57b72aade96738d3","ssdeep":"768:wz+37Hu5k5xLlmm6FUTlOGM9WEC9J2LbiWAIHS0W/l8jLMKgmedE4aWGsr4fRlzT:w67Hu5k5dlmtAmeH0E5GopFjMOw","tlshash":"7273ec3787d1133c6007ce9f5bd5a946517ae817e422bbe9b9634522cbcb6c24a6330f","first_seen":"2026-09-24T13:46:20.536604Z","last_seen":"2026-09-25T05:51:01.009458Z","times_seen":3,"resource_available":true,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":238,"receive":0,"ssl":13},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}}]}