{"report_id":"f9725068-a045-4d48-bfc9-96896f8e2466","version":0,"status":"done","tags":["wellsfargo","financial","phishing"],"date":"2026-09-24T13:46:28Z","url":{"schema":"http","addr":"auth-app-ajba9.ondigitalocean.app/","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"title":"Sign On to View Your Personal Accounts | Wells Fargo","dom":{"size":77327,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"f75433c6df7df78d267cdff38f0751dc","sha1":"254fbd1c148185967c80647ce024eed304b4bc28","sha256":"58054e75c1d44394b966847406863f07fda51940720555312b6d28e361b4b194","sha512":"edbeaaa46b7be813b249cc2b3ad3dbf39e55818b50d35b5000f9c8fb205a86906d01396b746e2d071e5c34823e59befe2a4f460f821f2804aad35416e8946c1c","ssdeep":"768:Oh99KgHu5kFUL1OGJ9gaECMJ2LbBvAPHS95djGKgmedEk8sr4fRl9nklEI3gJi5i:OkgHu5kFw3RW6csJELzWmtKJ6a","tlshash":"2173fc3797d1132c6007ce9f5bd5a946517af817e426bbe9b9630522cbcb9c24a2330f","dom_hash":"domhash27275fd315937bb23bebdd619bcdf7e5","first_seen":"2026-09-24T13:46:20.485458Z","last_seen":"2026-09-24T13:46:47.453176Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"auth-app-ajba9.ondigitalocean.app/","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-29T13:46:28Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"auth-app-ajba9.ondigitalocean.app","ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":95,"request_count":19,"received_data":639944,"sent_data":9605,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]}]},{"fqdn":"www15.wellsfargomedia.com","ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"domain_registered":"2009-06-25","domain_rank":196163,"first_seen":"2019-09-12T19:28:23Z","last_seen":"2026-09-24T13:46:13.337662Z","alert_count":0,"request_count":3,"received_data":72752,"sent_data":1724,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www10.wellsfargomedia.com","ip":{"addr":"23.52.23.95","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Sweden","country_code":"SE"},"domain_registered":"2009-06-25","domain_rank":90632,"first_seen":"2017-01-30T08:35:44Z","last_seen":"2026-09-24T00:38:45.576352Z","alert_count":0,"request_count":1,"received_data":508227,"sent_data":606,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/login-0e179d57d6b907b1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c363f021fe994ec8fa1a29659ce67038","sha1":"ed733a96ade81252ed4de4c361b79f47bc8c9567","sha256":"a8689bba1069a6fe8fbe203c2b2a980dd5aa5f2544124aa47f126aa794084976","sha512":"dc230a9f534c61938d3c2130e86905b978eb28788f60bd2ca91b1d3f14db9a66d4ed8fc2e5021d803bf7a2914e73f4a074dde870777b0b318a110c476c8bccc3","ssdeep":"384:ks3sska04Wv0ZpZI4qOqvdAsZ197L7cRWXmqOqvdAsZ197L7cRWAOOZpN8NeBr36:ks3ssdb+0Z44qOqvdAsZ197L7cRWXmqF","tlshash":"9d82e941a7a8159df403cc8861ff710eb1ef712db1d58da4bbe2ac6928568c43537bc6","size":18862,"data":"","first_seen":"2026-09-24T00:38:51.012921Z","last_seen":"2026-09-25T08:32:44.423537Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c2c4883d556cb241d1e89610cda8a85e","sha1":"8dad40ddf7a3f5adb7044b56eacff24de76a30e8","sha256":"02fa1890eac5060c9a299adc0fa850f5e08484630cda3373e7bb7179637965b3","sha512":"e4183b727a2c16005ea5f38a21e9d8caac6af83d6a967461ccf0642febe50d1317801fed1fb8723fb12fdd3cd14ef16c7f404c8e5552b69c4174e01c926cdd87","ssdeep":"","tlshash":"c541281b4007f6411ee1ccf278ab976389c0cd725d342b509add9f2c82d0fa6776e822","size":2430,"data":"","first_seen":"2026-09-24T13:46:20.533083Z","last_seen":"2026-09-25T05:51:01.012875Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/framework-9b5d6ec4444c80fa.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4f45f9a036208ef5b00302eaa0de99d4","sha1":"6271883ba52614a6412d4146f7b905cd75807c55","sha256":"1aee3a5f0c4b6735edff60d58f20a936ce11e5d4a36a5a76390aeda043ae4048","sha512":"e010606db08a71a7111170882ab6d6f807d6f13a49dda0d587fadcde6f7c2991993d2268792fbf1526c618188fb3024730ac893e41ead69646fe762ea234376c","ssdeep":"1536:KbCvuM7U0K2HEu+ZXnQ5Sw77nhZbqDNqGSMbXmbGWCufSTKSygJuR:KbCa2kucQwnSimHSTKSygMR","tlshash":"fdd309e97956f6536a7312ab00af1803727c6927780c8c70e240eed975bc479a17bf8d","size":141509,"data":"","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.420974Z","times_seen":176,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/main-3123a443c688934f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5c8fa4faef8700c12dd2c8fe8b29ee96","sha1":"6882f5b250869c46d913875d48ae03c2b9be449d","sha256":"0eed4542b90a01be928023ec3dc7abed45c63ffc8067a496863ecef579d4af9f","sha512":"14f7aa71733af380b5ba661183daf80f68895e6c02908fd09f788407a93a092ae2f040071d6d8748c1072726d3071d6f68f815a2f8d415292b1f5f8f6bd87b8e","ssdeep":"1536:zkF5kayDDfhPDrwJw4lwON7npFW9TR2pS9w:nayIBrnhpS9w","tlshash":"d4a3e7a871e2f882459266b1803f100bf27a5c7af05dac91a39eccd17e74d4ea173f59","size":104950,"data":"","first_seen":"2023-03-07T16:53:51Z","last_seen":"2026-09-25T08:32:44.413062Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/463-d1ffc92465982ad1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"11bf3cd819d9c431721fc48f555fe313","sha1":"c5a1d854ffd15e725157340d55a8930ce527f24c","sha256":"179e5f9b4c0a9481d03deffae6657f5bbed8e09c4ce0111283818378bfa14ab6","sha512":"c3dc4cd13a780b67bdc2b312d026256a64f6b8c58c2d601822c32362be87079cf2c7aebeac979627f9afb07babb936a9c880250a7f9c9f948a06acc9027e815f","ssdeep":"768:ubJa80WZHgVN4Dx5jrqXFqvFnkdgJQQ+WMc5ZnSHX:u9a80WZHgVNWx5jr6qv5kdgJcqZS3","tlshash":"50332ca8f6c1f923a56340d8d1ef442bb7a9b561f70e0c54f177c8c92ba809c5262f9d","size":50776,"data":"","first_seen":"2026-09-24T13:46:20.530935Z","last_seen":"2026-09-25T05:51:01.011243Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/995-23d4606ec37e3134.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"fb29b5fa3b79aeeceedeb1d67ca017d5","sha1":"05de4faacdf95679f780ee00c0b1ca1d3a65e1cb","sha256":"b7e6d113c49c58b4e723329668f1adaa699eed95036a88f9c25f4db71461b8a3","sha512":"455bf398b623a7d3d07ca6e9451498529e9b570a5421a72cd6ad4bc1da9149eaf25e19577cee5cee7c4e657b80e4e78d5d55c4d213f8fcb8cd9cfe2a1a717ae1","ssdeep":"192:/xH+milOAulOgFcVlbiZl1fZDLPxXidmdnul4m7e0:krgYiZl1fZDLPxXiEnulLN","tlshash":"11f1a4a4fb80f670b96f85cc6def08d5ef7425109b5c1cbaf8a65049025f2c58463e8e","size":7668,"data":"","first_seen":"2026-09-24T13:46:20.531866Z","last_seen":"2026-09-25T05:51:01.006975Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/_app-7e0dffbdb63082b7.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c03149fe6a8412303fb7fc7c49ed3e2e","sha1":"4ef2f25990a0733059b1fa7737e463ab6a51948c","sha256":"0a2f88b46163cbcc1031f9ba819d63b6218fd8bbaca360a3842fc10b003e0c9a","sha512":"a657e71cb6c519f7547268fd0d3271637c7183abfca074b9f7a6c95ac2affb2f9f289bf2f55147ee5ee4312e4defc740ad25e3a79e06d6a4237c3bb36361d101","ssdeep":"768:DJL0B04NXIyB/JhjLC0kg6mGtSMJCepPYagDSL5T+e:8nbhjV6mGtSePTgDSL5Se","tlshash":"dfe2f9dd72e2f10687a3e4a640af548bb97dac14b04c4cb6ea80d9d17a784bd4137f9c","size":33480,"data":"","first_seen":"2026-09-24T00:38:51.036296Z","last_seen":"2026-09-25T08:32:44.416772Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/217-fc4ca4bc23c5eb89.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9ac5e786f88fe4efe5a54e23a7786ad","sha1":"14418486bbd22b01ed8d6e93b87ee08e71f34155","sha256":"1f6db8541d75dcacbef78c15894ebc5f8e5d184fb74527ce5a98d8e6a9ec3cd8","sha512":"6d6c14e26caa4bcaefe03d01135a6df9fc5f114e5d5c01edbfdb81eefdc2bffa7bb3b5eca48cc5241193abfddc47ecadb72d0764956b47a182aa8d78841db737","ssdeep":"192:0fCqtsk9qPVGKipX8v89xkvhRMoqlDfqTdba1cKVNNqwoB+K7nxD120Yi6yvn/rw:WptSOXQkuhGoqlDfiQBIX6yvzqPc8","tlshash":"4752f8a8b041b8715a9771e280bf080fb13824a531094ca5f7e6fdd85ef86a84127f9e","size":13293,"data":"","first_seen":"2026-09-24T00:38:51.037789Z","last_seen":"2026-09-25T08:32:44.421505Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/669-339d55ad45077513.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"992799c812675e5cc284338be275216d","sha1":"383f2b719001689266adee39e140b27e57f76d7f","sha256":"2cae64aa1dc40773ef634f794abccec2b44f26ad61d811a8a969d535c6bb34d2","sha512":"a74ad61e9b091c0c098058a8838554f2c587fd17a8f40db2bc59f88f65235064eee02761d2f56b0083425b3e64cf4fcd9d1fc852e2c41045e619bdd416fb4a24","ssdeep":"768:hlbTUeh1RemrALFrjUgLk+VL0I4fJqTeA4Bd1XM6BNgW/9I46ZVtYVLuB:7wmXAxrjUglVL0HETeAsd1XM6BNqLYNQ","tlshash":"8813d685baa6b01283a331e1406f444ff179f939f49c5cb4b280e4e129b49ad857ff6c","size":44954,"data":"","first_seen":"2026-09-24T13:46:20.503913Z","last_seen":"2026-09-25T05:51:01.010661Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/643-49ffaa237a345b9d.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c355a95e04afe3e1b32dbfd458038360","sha1":"d9f67375b6d52d4060e1fe44d887f77af88744dd","sha256":"3d431fcd761bfbdc9592b3f636c8929ad8aa39ab7475122ce156158a1706dff9","sha512":"96d2f57994ac01f49f18ea87e77a9a73979a3b0553e6273fd4681ca0f275d54ced1c3ee077bd408aea90c3090c47aa7516cfe5aff141dcd46694ee0a3bb3acc5","ssdeep":"192:matg+LsetFyOo6iAhTMFSmeDogQlPmm6znQCUT4CR+EsCGSFBVHkgK40:/gHfBFS57ePmm6znBUTvQE3GSRHr0","tlshash":"4362f91aa3d8275e7906c7a4307ba50fb2cf207f72b4cb65e211fa3675118e4146abc7","size":15554,"data":"","first_seen":"2026-09-24T00:38:51.011382Z","last_seen":"2026-09-25T08:32:44.422905Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5352cb582146311d1540f6075d1f265e","sha1":"cbe5dad683f4f887122db6f6d343aa8ba41dee8b","sha256":"e182e3257a3b5564f7bfb9fb1c6a1e13f8f7c9a3fa0dd6e39ccf473ef8d4f960","sha512":"50b05ff9c7703a5997b538c02a177a32bc91ce03de33779039fe5f1eccb1d2b8f04735a24cad024999c0c937160d3fce66a9b1c114a5b8e95e8c11afcff59654","ssdeep":"","tlshash":"a4a001e0943cdc60aa63dd1c136413128fa05122651d28938afd3044c0301510300d90","size":76,"data":"","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.425501Z","times_seen":667,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/139-88233707e5e1051f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"40019529f08d66073ce8fd2b82fa8986","sha1":"dd6e83bcc6bac32b645da9210883fb1edc0c22b5","sha256":"edfba3685111667e6f265d8624bab1c4ad9a454e96f453409f241900d69f9182","sha512":"855705c22da55697d3b114d134fe9d65eae2371ed00047945c2d1cd54379c401276816b31ee9c0d21abafe3decb0376f32a1e3f7ab97f7f082e9a558c8541363","ssdeep":"192:XHJuUu3y/HVvYswWyVoDRZv2U7vb1ZsG0:XHIJ3iumyVoDRRT7vb1ZsG0","tlshash":"d2e1d998d9d57c6ffe2f518acacf4c22f30da820b71d48a5f1b29685115c14813a3bee","size":6989,"data":"","first_seen":"2026-09-24T13:46:20.522851Z","last_seen":"2026-09-25T05:51:01.011778Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/540-a68c3ead76933934.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"31af69e34680f9c8244cc621b9d54d6c","sha1":"af2f86fe9f8ece104f9defc90b0f713c591a6994","sha256":"7c6e8a8d7d4d404770030f9a7a917fd0ab1392fe71b68f32f7f96972d0bf05fe","sha512":"c5fbaa69db3d24626a8f171685449f11cf4e0b764d507356d75aff2bc04e41715e55bd8af0282bc2381d339872d65c35697828a6f299eaf84504095912bf5dc2","ssdeep":"192:F+x+6Wu80ovRhTvFa7XYa267UKskmhM9r4Uz70rk1NnGOOAvCP3:UxEu8pvRhTvsca267UVjM9rxAI1NbLC/","tlshash":"b462e7bcebc0b8264d7bc1cdd6ef481ae66ca061a70918b5f0970d40279d2dd1627fac","size":14918,"data":"","first_seen":"2026-09-24T13:46:20.525194Z","last_seen":"2026-09-25T05:51:01.012329Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/webpack-bb469f829a664d48.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"09985188723a77d0dc96533b3177fb30","sha1":"120be09a92353d98363349d3a6459a296e2bf760","sha256":"5dfe185409ff8cc0e73ea870cbefbcdac38297bbfa69c545686e536f7c51fa64","sha512":"a2d353fda78dd8e922c37d5a555a56af304c0b836da56290a8a453da2c1665c12e59e560de474509ae42bb5602f316488987c8f49ad1d079dcb77df10e287638","ssdeep":"","tlshash":"4b410bd931e6f4d6166b7a60013f481bf02b98f2f06ca4e49354c8f13d7029a9032f9e","size":2193,"data":"","first_seen":"2023-03-07T01:36:05Z","last_seen":"2026-09-25T08:32:44.42433Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/785-194388d0a8adb6a6.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"f0b132b999b0e4c981df1a6011b1ff04","sha1":"c5ef57811be8018fc738e67f81eff24bc08b2ce1","sha256":"b548ced5d5c606131cb8d49dfefc13b58d6a199229365e5b8964ebb1e4d584a5","sha512":"493824644a07215243494eb76e38848dbef0eec8ad8ed4313c44970ead83c2d40762761d93f8ed67b7d35552dc5701c084854a55f4262d0dcc2888bd333b6c61","ssdeep":"1536:YoFItVhwfdoXHb0juA2ugi+K4RJksHEY/WM859rMbHXKMbxhoVbFxbR:4hFA29icRJksHE2LWyXRhO","tlshash":"1e73d6c4b793b456837a78a4402f400bf27a9db9f04ccc98f2a5d5d2797866d906af3c","size":79898,"data":"","first_seen":"2026-09-24T00:38:51.020899Z","last_seen":"2026-09-25T08:32:44.427394Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/_app-7e0dffbdb63082b7.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.554Z","timestamp":1790257557554,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/pages/_app-7e0dffbdb63082b7.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"82c8-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=lbfJW7KfSPPwJfIwpe9SLruYxwRsg.uokGM3XWQJkUE-1790257557.5580337-1.0.1.1-bVEeATTIQik6DXTvFXYclpwi2XGRYvittKQr6_wyMWs1BVrw4UpqdNjDZv7gKv.ceZD9RG5FEHvenUZ9kOIgZAeIkKr5uM_DV078.po_p4tSHgMAbte59pR9cCPqAwLX; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b916a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"lbfJW7KfSPPwJfIwpe9SLruYxwRsg.uokGM3XWQJkUE-1790257557.5580337-1.0.1.1-bVEeATTIQik6DXTvFXYclpwi2XGRYvittKQr6_wyMWs1BVrw4UpqdNjDZv7gKv.ceZD9RG5FEHvenUZ9kOIgZAeIkKr5uM_DV078.po_p4tSHgMAbte59pR9cCPqAwLX","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=lbfJW7KfSPPwJfIwpe9SLruYxwRsg.uokGM3XWQJkUE-1790257557.5580337-1.0.1.1-bVEeATTIQik6DXTvFXYclpwi2XGRYvittKQr6_wyMWs1BVrw4UpqdNjDZv7gKv.ceZD9RG5FEHvenUZ9kOIgZAeIkKr5uM_DV078.po_p4tSHgMAbte59pR9cCPqAwLX; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":33480,"size_decoded":13828,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (33480), with no line terminators","md5":"c03149fe6a8412303fb7fc7c49ed3e2e","sha1":"4ef2f25990a0733059b1fa7737e463ab6a51948c","sha256":"0a2f88b46163cbcc1031f9ba819d63b6218fd8bbaca360a3842fc10b003e0c9a","sha512":"a657e71cb6c519f7547268fd0d3271637c7183abfca074b9f7a6c95ac2affb2f9f289bf2f55147ee5ee4312e4defc740ad25e3a79e06d6a4237c3bb36361d101","ssdeep":"768:DJL0B04NXIyB/JhjLC0kg6mGtSMJCepPYagDSL5T+e:8nbhjV6mGtSePTgDSL5Se","tlshash":"dfe2f9dd72e2f10687a3e4a640af548bb97dac14b04c4cb6ea80d9d17a784bd4137f9c","first_seen":"2026-09-24T00:38:51.036296Z","last_seen":"2026-09-25T08:32:44.416772Z","times_seen":10,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/669-339d55ad45077513.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.556Z","timestamp":1790257557556,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/669-339d55ad45077513.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"af9a-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=vBwJnCiAbFUYYObZjuTvvHChzqStmMfLGK9O2oR5ezM-1790257557.559234-1.0.1.1-hnGALTzg6oGRzG5wQn6wnsHgFnwz2lLr7bRLy8vcXwsRvp.QXtWHuJy3qknPTkUe_h4LM3yrZXhCswcriAYWGYLxarBhSkJ8HofEqARB8SxAiRPR2BtRmOcdsUvd_7IB; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b923a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"vBwJnCiAbFUYYObZjuTvvHChzqStmMfLGK9O2oR5ezM-1790257557.559234-1.0.1.1-hnGALTzg6oGRzG5wQn6wnsHgFnwz2lLr7bRLy8vcXwsRvp.QXtWHuJy3qknPTkUe_h4LM3yrZXhCswcriAYWGYLxarBhSkJ8HofEqARB8SxAiRPR2BtRmOcdsUvd_7IB","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=vBwJnCiAbFUYYObZjuTvvHChzqStmMfLGK9O2oR5ezM-1790257557.559234-1.0.1.1-hnGALTzg6oGRzG5wQn6wnsHgFnwz2lLr7bRLy8vcXwsRvp.QXtWHuJy3qknPTkUe_h4LM3yrZXhCswcriAYWGYLxarBhSkJ8HofEqARB8SxAiRPR2BtRmOcdsUvd_7IB; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44954,"size_decoded":15567,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (23341)","md5":"992799c812675e5cc284338be275216d","sha1":"383f2b719001689266adee39e140b27e57f76d7f","sha256":"2cae64aa1dc40773ef634f794abccec2b44f26ad61d811a8a969d535c6bb34d2","sha512":"a74ad61e9b091c0c098058a8838554f2c587fd17a8f40db2bc59f88f65235064eee02761d2f56b0083425b3e64cf4fcd9d1fc852e2c41045e619bdd416fb4a24","ssdeep":"768:hlbTUeh1RemrALFrjUgLk+VL0I4fJqTeA4Bd1XM6BNgW/9I46ZVtYVLuB:7wmXAxrjUglVL0HETeAsd1XM6BNqLYNQ","tlshash":"8813d685baa6b01283a331e1406f444ff179f939f49c5cb4b280e4e129b49ad857ff6c","first_seen":"2026-09-24T13:46:20.503913Z","last_seen":"2026-09-25T05:51:01.010661Z","times_seen":3,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/785-194388d0a8adb6a6.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.563Z","timestamp":1790257557563,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/785-194388d0a8adb6a6.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1381a-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=Di.Bda1S.dk193.4LiAj1gt1lkLSp5Hj_0rQL56HYqQ-1790257557.5658593-1.0.1.1-B5Uj_RbB0HJC1W.HxQwaI2EI4ZDDSHg4pf2UFp9l_Oi2R5KzGa_UL9DbLowNBIhuHof4FVXyBJdi2U.4fBObX.Kxz7jnoTWI8NPlgwYi4yN_BfCRjakAK9DkDRnsAxip; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c93ca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"Di.Bda1S.dk193.4LiAj1gt1lkLSp5Hj_0rQL56HYqQ-1790257557.5658593-1.0.1.1-B5Uj_RbB0HJC1W.HxQwaI2EI4ZDDSHg4pf2UFp9l_Oi2R5KzGa_UL9DbLowNBIhuHof4FVXyBJdi2U.4fBObX.Kxz7jnoTWI8NPlgwYi4yN_BfCRjakAK9DkDRnsAxip","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=Di.Bda1S.dk193.4LiAj1gt1lkLSp5Hj_0rQL56HYqQ-1790257557.5658593-1.0.1.1-B5Uj_RbB0HJC1W.HxQwaI2EI4ZDDSHg4pf2UFp9l_Oi2R5KzGa_UL9DbLowNBIhuHof4FVXyBJdi2U.4fBObX.Kxz7jnoTWI8NPlgwYi4yN_BfCRjakAK9DkDRnsAxip; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":79898,"size_decoded":27368,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (39786)","md5":"f0b132b999b0e4c981df1a6011b1ff04","sha1":"c5ef57811be8018fc738e67f81eff24bc08b2ce1","sha256":"b548ced5d5c606131cb8d49dfefc13b58d6a199229365e5b8964ebb1e4d584a5","sha512":"493824644a07215243494eb76e38848dbef0eec8ad8ed4313c44970ead83c2d40762761d93f8ed67b7d35552dc5701c084854a55f4262d0dcc2888bd333b6c61","ssdeep":"1536:YoFItVhwfdoXHb0juA2ugi+K4RJksHEY/WM859rMbHXKMbxhoVbFxbR:4hFA29icRJksHE2LWyXRhO","tlshash":"1e73d6c4b793b456837a78a4402f400bf27a9db9f04ccc98f2a5d5d2797866d906af3c","first_seen":"2026-09-24T00:38:51.020899Z","last_seen":"2026-09-25T08:32:44.427394Z","times_seen":10,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.816Z","timestamp":1790257557816,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22424\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5798\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:57 GMT\r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22424,"size_decoded":22764,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22424, version 1.13107","md5":"0a1639ebe9fab396657a62aa5233c832","sha1":"9b58164729ad918dd7255e4856f9da7f3a90bfde","sha256":"631f3b6267a831a8d67c45e480b5d5a2601f10ff8708bcf3a45a41b377a129cc","sha512":"a3786f7c1188bcbddcabe54e40dfbc77d842b1a19d2cca56cedaeb3c1a8126b3c203ac8b6297268c94aedf270be2b822aa8ac0de9e1e5c6d42bc7866324d8128","ssdeep":"384:ZWomH3hR7XCKb7GSa5mSWAmtXnCe83/17wdTgm6keJR60vqy:ZWDL7va5mSWbn4cdEmhJvy","tlshash":"cda2e16e1fb4ae24ec1c3bb164a5d0ed75c744750470c45fa331a0d626c5d4c9d86ef9","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-09-25T08:32:44.415372Z","times_seen":1649,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":30,"connect":3,"send":0,"wait":14,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/favicon.ico","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:58.021Z","timestamp":1790257558021,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:58 GMT\r\ncontent-type: image/x-icon\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"47e-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=6,i=?0\r\ncf-cache-status: BYPASS\r\nset-cookie: __cf_bm=_mxk8Zms6fqnqj40VvPzYtluX90nKjiS0eFKq.6JfdU-1790257558.0230556-1.0.1.1-jPF.AjtBePGaqi78gbvpJmZ0nHcwuO.RTEk2xZ4Sb93RYxAylsCntVIw2NifY06L1O1gnexVEoSrHoglu0W49CO1AvW_W.PUZ9o2_exYsPAXnXM1KYVd2Hc8cE05QyrP; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:58 GMT\r\ncf-ray: a4023b89abaca0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"_mxk8Zms6fqnqj40VvPzYtluX90nKjiS0eFKq.6JfdU-1790257558.0230556-1.0.1.1-jPF.AjtBePGaqi78gbvpJmZ0nHcwuO.RTEk2xZ4Sb93RYxAylsCntVIw2NifY06L1O1gnexVEoSrHoglu0W49CO1AvW_W.PUZ9o2_exYsPAXnXM1KYVd2Hc8cE05QyrP","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:58Z","raw_expires":"Thu, 24 Sep 2026 14:15:58 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=_mxk8Zms6fqnqj40VvPzYtluX90nKjiS0eFKq.6JfdU-1790257558.0230556-1.0.1.1-jPF.AjtBePGaqi78gbvpJmZ0nHcwuO.RTEk2xZ4Sb93RYxAylsCntVIw2NifY06L1O1gnexVEoSrHoglu0W49CO1AvW_W.PUZ9o2_exYsPAXnXM1KYVd2Hc8cE05QyrP; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:58 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":1150,"size_decoded":1323,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel","md5":"11e6b612207abf064158e69540c16e24","sha1":"9e3912485514553b2e17b578c8340986f1172b4d","sha256":"8670da3c95c03b59b091eac882b67e0b59b765c455b8d871abd2e55d4618573b","sha512":"2a1257c597a985ae9da8a029a2bab00e2cda2106026578ac382c7319f4754d42c47e51f59a3f45f1228e4e036b00707a9b087d6dbf18821327f187e4e79ea24f","ssdeep":"","tlshash":"93214200430423acdcabd273f6027b69044f2d2ed9c5613f634038d5a4aff7608e3648","first_seen":"2023-05-08T02:46:24Z","last_seen":"2026-09-25T08:32:44.426693Z","times_seen":860,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/framework-9b5d6ec4444c80fa.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.550Z","timestamp":1790257557550,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/framework-9b5d6ec4444c80fa.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"228c5-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=L5Xtv8S3hWZmnFuUPWP5md3.RaSKR7qoY0jADYJdjtg-1790257557.5545592-1.0.1.1-5Lxc3JDRWXBFwaByZAtC9r2DrSHvIY2op5ZwspolrGyWySw0PB0ML1s02Dv1vmKYZupFt_BDalMfx7FnTMWPTMNf2xefA_Kv2tetTQyvezaxn0Ckkpun6u_KQ3s4sdb9; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b906a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"L5Xtv8S3hWZmnFuUPWP5md3.RaSKR7qoY0jADYJdjtg-1790257557.5545592-1.0.1.1-5Lxc3JDRWXBFwaByZAtC9r2DrSHvIY2op5ZwspolrGyWySw0PB0ML1s02Dv1vmKYZupFt_BDalMfx7FnTMWPTMNf2xefA_Kv2tetTQyvezaxn0Ckkpun6u_KQ3s4sdb9","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=L5Xtv8S3hWZmnFuUPWP5md3.RaSKR7qoY0jADYJdjtg-1790257557.5545592-1.0.1.1-5Lxc3JDRWXBFwaByZAtC9r2DrSHvIY2op5ZwspolrGyWySw0PB0ML1s02Dv1vmKYZupFt_BDalMfx7FnTMWPTMNf2xefA_Kv2tetTQyvezaxn0Ckkpun6u_KQ3s4sdb9; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":141509,"size_decoded":46731,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65154)","md5":"4f45f9a036208ef5b00302eaa0de99d4","sha1":"6271883ba52614a6412d4146f7b905cd75807c55","sha256":"1aee3a5f0c4b6735edff60d58f20a936ce11e5d4a36a5a76390aeda043ae4048","sha512":"e010606db08a71a7111170882ab6d6f807d6f13a49dda0d587fadcde6f7c2991993d2268792fbf1526c618188fb3024730ac893e41ead69646fe762ea234376c","ssdeep":"1536:KbCvuM7U0K2HEu+ZXnQ5Sw77nhZbqDNqGSMbXmbGWCufSTKSygJuR:KbCa2kucQwnSimHSTKSygMR","tlshash":"fdd309e97956f6536a7312ab00af1803727c6927780c8c70e240eed975bc479a17bf8d","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.420974Z","times_seen":176,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/463-d1ffc92465982ad1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.558Z","timestamp":1790257557558,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/463-d1ffc92465982ad1.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"c658-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=KRICEd7E9PXSNhq5a7PVaqtw8WEYJ7DKxCitKeNtIYI-1790257557.561602-1.0.1.1-VTIloQkKTAcKZpt1kGvZuWkDtmyll4SABttXZPOwv2uviG_qe0qsVndfgWSsFPQqAqPLaUmcijeykrWRIh5aJ9lfXuJwGx7t8QFtH.Y.jY0JQt9elAdRrrZND0p35dQn; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c927a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"KRICEd7E9PXSNhq5a7PVaqtw8WEYJ7DKxCitKeNtIYI-1790257557.561602-1.0.1.1-VTIloQkKTAcKZpt1kGvZuWkDtmyll4SABttXZPOwv2uviG_qe0qsVndfgWSsFPQqAqPLaUmcijeykrWRIh5aJ9lfXuJwGx7t8QFtH.Y.jY0JQt9elAdRrrZND0p35dQn","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=KRICEd7E9PXSNhq5a7PVaqtw8WEYJ7DKxCitKeNtIYI-1790257557.561602-1.0.1.1-VTIloQkKTAcKZpt1kGvZuWkDtmyll4SABttXZPOwv2uviG_qe0qsVndfgWSsFPQqAqPLaUmcijeykrWRIh5aJ9lfXuJwGx7t8QFtH.Y.jY0JQt9elAdRrrZND0p35dQn; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":50776,"size_decoded":16819,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (28458)","md5":"11bf3cd819d9c431721fc48f555fe313","sha1":"c5a1d854ffd15e725157340d55a8930ce527f24c","sha256":"179e5f9b4c0a9481d03deffae6657f5bbed8e09c4ce0111283818378bfa14ab6","sha512":"c3dc4cd13a780b67bdc2b312d026256a64f6b8c58c2d601822c32362be87079cf2c7aebeac979627f9afb07babb936a9c880250a7f9c9f948a06acc9027e815f","ssdeep":"768:ubJa80WZHgVN4Dx5jrqXFqvFnkdgJQQ+WMc5ZnSHX:u9a80WZHgVNWx5jr6qv5kdgJcqZS3","tlshash":"50332ca8f6c1f923a56340d8d1ef442bb7a9b561f70e0c54f177c8c92ba809c5262f9d","first_seen":"2026-09-24T13:46:20.530935Z","last_seen":"2026-09-25T05:51:01.011243Z","times_seen":3,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargosans-sbd.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.820Z","timestamp":1790257557820,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargosans-sbd.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 22600\r\nlast-modified: Tue, 26 Feb 2019 19:38:34 GMT\r\netag: \"5c7595ba-5848\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:57 GMT\r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":22600,"size_decoded":22940,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22600, version 1.13107","md5":"83df8749c013f13019fa8e0912041759","sha1":"2bbffcf012a59e47661c0a37edda0fc772992ae7","sha256":"ab9d8c97b35ed86b6224aca911aa304a0d7dbcbd28e00a4c6585b96e28ed30ba","sha512":"60ef81e9500e9b33e9d799d4bd56f8ef4df5dfdc88a42d5739c3da65733cfaedd42aa0dc623d46b370dc750c693cbe0c473c92e6c4c2a7bed2c7da33b8bcee84","ssdeep":"384:X4TnfMKBnolaid+tMKsLZqy+1EooqFdf8THOgmFtI2ErNX0sAZwk+pcHgXvCdFPh:XWXBolb+tMKoc1E1qFdgHOujisY+pcHt","tlshash":"5ba2d0f0681f37b4473b083c3472a3ca80f69516eaea19951b3d123e699ada5934c37d","first_seen":"2023-04-13T05:35:56Z","last_seen":"2026-09-25T08:32:44.426085Z","times_seen":1478,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":-1,"dns":26,"connect":4,"send":0,"wait":9,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/main-3123a443c688934f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.552Z","timestamp":1790257557552,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/main-3123a443c688934f.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"199f6-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=klW9ztWm1BcW71yaeMFbp9Ug_FSc5xApwxS9BuVjkNU-1790257557.5557501-1.0.1.1-t9IWdz_70jsZRY9rIEFjUElxpqOhVi2Ekz0wD2T45B8ftd.LRMtxrdNI_UXNt.5DGEzKMEg673bKnjpFnpj1SEGXRJQgd1msKKeMQe.DLbh4loRNa30YcsmhHARqnu8D; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b90ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"klW9ztWm1BcW71yaeMFbp9Ug_FSc5xApwxS9BuVjkNU-1790257557.5557501-1.0.1.1-t9IWdz_70jsZRY9rIEFjUElxpqOhVi2Ekz0wD2T45B8ftd.LRMtxrdNI_UXNt.5DGEzKMEg673bKnjpFnpj1SEGXRJQgd1msKKeMQe.DLbh4loRNa30YcsmhHARqnu8D","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=klW9ztWm1BcW71yaeMFbp9Ug_FSc5xApwxS9BuVjkNU-1790257557.5557501-1.0.1.1-t9IWdz_70jsZRY9rIEFjUElxpqOhVi2Ekz0wD2T45B8ftd.LRMtxrdNI_UXNt.5DGEzKMEg673bKnjpFnpj1SEGXRJQgd1msKKeMQe.DLbh4loRNa30YcsmhHARqnu8D; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":104950,"size_decoded":31885,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5c8fa4faef8700c12dd2c8fe8b29ee96","sha1":"6882f5b250869c46d913875d48ae03c2b9be449d","sha256":"0eed4542b90a01be928023ec3dc7abed45c63ffc8067a496863ecef579d4af9f","sha512":"14f7aa71733af380b5ba661183daf80f68895e6c02908fd09f788407a93a092ae2f040071d6d8748c1072726d3071d6f68f815a2f8d415292b1f5f8f6bd87b8e","ssdeep":"1536:zkF5kayDDfhPDrwJw4lwON7npFW9TR2pS9w:nayIBrnhpS9w","tlshash":"d4a3e7a871e2f882459266b1803f100bf27a5c7af05dac91a39eccd17e74d4ea173f59","first_seen":"2023-03-07T16:53:51Z","last_seen":"2026-09-25T08:32:44.413062Z","times_seen":33,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/139-88233707e5e1051f.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.561Z","timestamp":1790257557561,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/139-88233707e5e1051f.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1b4d-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=G4pfa4gf1CZnZ1Aw4pXbTs4CsKqPPdkFgNdkDBWv5mo-1790257557.5652554-1.0.1.1-nPY2mLpLkBGfcM7w6GxlgA6ihfDH42tlaYQhfaTj5bQ_okTPUB0BwaVhI.dj4UNWM5VnjWORUanOssrRaarVd30XJm59tJQ5ZmBANNEOGOjPXwJUnOMlrvEPTvJxvWaB; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c93ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"G4pfa4gf1CZnZ1Aw4pXbTs4CsKqPPdkFgNdkDBWv5mo-1790257557.5652554-1.0.1.1-nPY2mLpLkBGfcM7w6GxlgA6ihfDH42tlaYQhfaTj5bQ_okTPUB0BwaVhI.dj4UNWM5VnjWORUanOssrRaarVd30XJm59tJQ5ZmBANNEOGOjPXwJUnOMlrvEPTvJxvWaB","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=G4pfa4gf1CZnZ1Aw4pXbTs4CsKqPPdkFgNdkDBWv5mo-1790257557.5652554-1.0.1.1-nPY2mLpLkBGfcM7w6GxlgA6ihfDH42tlaYQhfaTj5bQ_okTPUB0BwaVhI.dj4UNWM5VnjWORUanOssrRaarVd30XJm59tJQ5ZmBANNEOGOjPXwJUnOMlrvEPTvJxvWaB; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6989,"size_decoded":3353,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6987), with no line terminators","md5":"40019529f08d66073ce8fd2b82fa8986","sha1":"dd6e83bcc6bac32b645da9210883fb1edc0c22b5","sha256":"edfba3685111667e6f265d8624bab1c4ad9a454e96f453409f241900d69f9182","sha512":"855705c22da55697d3b114d134fe9d65eae2371ed00047945c2d1cd54379c401276816b31ee9c0d21abafe3decb0376f32a1e3f7ab97f7f082e9a558c8541363","ssdeep":"192:XHJuUu3y/HVvYswWyVoDRZv2U7vb1ZsG0:XHIJ3iumyVoDRRT7vb1ZsG0","tlshash":"d2e1d998d9d57c6ffe2f518acacf4c22f30da820b71d48a5f1b29685115c14813a3bee","first_seen":"2026-09-24T13:46:20.522851Z","last_seen":"2026-09-25T05:51:01.011778Z","times_seen":3,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.568Z","timestamp":1790257557568,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/BEYrwHpT9MOtdnX46sQSB/_buildManifest.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"97e-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=wcpkPGEtcuAuSPxWg_zd_o.pCKGhaLFV7dESo_WueG0-1790257557.5713975-1.0.1.1-y2f.ZcEGYuHSLSeL1V70sEojGSvhUQPsLnnxNDba34E3.hMe4fnDrtInCatalyEFJGgw.o6D07U1Wn.7Y9.lCGXOaUmnxhLvNT7jjpMFEC8cEA1NueswIjHHQzBhJT4x; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86d955a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"wcpkPGEtcuAuSPxWg_zd_o.pCKGhaLFV7dESo_WueG0-1790257557.5713975-1.0.1.1-y2f.ZcEGYuHSLSeL1V70sEojGSvhUQPsLnnxNDba34E3.hMe4fnDrtInCatalyEFJGgw.o6D07U1Wn.7Y9.lCGXOaUmnxhLvNT7jjpMFEC8cEA1NueswIjHHQzBhJT4x","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=wcpkPGEtcuAuSPxWg_zd_o.pCKGhaLFV7dESo_WueG0-1790257557.5713975-1.0.1.1-y2f.ZcEGYuHSLSeL1V70sEojGSvhUQPsLnnxNDba34E3.hMe4fnDrtInCatalyEFJGgw.o6D07U1Wn.7Y9.lCGXOaUmnxhLvNT7jjpMFEC8cEA1NueswIjHHQzBhJT4x; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2430,"size_decoded":1717,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with very long lines (2430), with no line terminators","md5":"c2c4883d556cb241d1e89610cda8a85e","sha1":"8dad40ddf7a3f5adb7044b56eacff24de76a30e8","sha256":"02fa1890eac5060c9a299adc0fa850f5e08484630cda3373e7bb7179637965b3","sha512":"e4183b727a2c16005ea5f38a21e9d8caac6af83d6a967461ccf0642febe50d1317801fed1fb8723fb12fdd3cd14ef16c7f404c8e5552b69c4174e01c926cdd87","ssdeep":"","tlshash":"c541281b4007f6411ee1ccf278ab976389c0cd725d342b509add9f2c82d0fa6776e822","first_seen":"2026-09-24T13:46:20.533083Z","last_seen":"2026-09-25T05:51:01.012875Z","times_seen":3,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www15.wellsfargomedia.com/wfui/css/fonts/wellsfargoserif-rg.woff2","fqdn":"www15.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"184.25.9.85","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.819Z","timestamp":1790257557819,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www15.wellsfargomedia.com","organization":""},"issuer":{"commonName":"Wells Fargo Public Trust Certification Authority 01 G2","organization":"Wells Fargo \u0026 Company"},"validity":{"start":"Wed, 09 Sep 2026 00:00:00 GMT","end":"Fri, 26 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D8:D6:60:8F:33:67:B8:EC:A3:20:7B:B2:4F:82:F9:4F:1B:4A:81:2E","sha256":"AF:57:27:23:02:12:E4:BD:A5:FC:ED:FB:5B:17:9F:73:7B:54:0A:68:78:FC:55:2F:E0:3E:E2:91:EA:F1:BE:C2"}}},"request":{"raw":"GET /wfui/css/fonts/wellsfargoserif-rg.woff2 HTTP/1.1\r\nHost: www15.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://auth-app-ajba9.ondigitalocean.app\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: KONICHIWA/2.0\r\ncontent-type: font/woff2\r\ncontent-length: 26708\r\nlast-modified: Mon, 11 Mar 2019 20:52:01 GMT\r\netag: \"5c86ca71-6854\"\r\naccess-control-allow-origin: *\r\naccept-ranges: bytes\r\ncache-control: max-age=31536000\r\nexpires: Fri, 24 Sep 2027 13:45:57 GMT\r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26708,"size_decoded":27048,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26708, version 1.13107","md5":"885d42ab7ffcffc42ed29816c3ce9727","sha1":"3d84cb41ddfb5bf8627e2b9dc867237bea47baad","sha256":"aeb7b3bfc4281d35b02dfde05ac7a6c0d3daa7f3123b35a9cbd4b5a8e3f3c310","sha512":"1b64ea9a7598a69dc5837f70af7eb702171fb55dfc58aa071a5efe70522676da4cbc1d3af054ab3b8f325143479d484388917e015e9ab61b5b7322077461fb11","ssdeep":"768:NqcUCwKb4mdzrl3vUSwXTRoji0iG6dlLsCPlT:NqrCwkTlLwV0izRPZ","tlshash":"c4c2e2c8099724dedb6d81eea692155e3f01c2df861a009a419ecc4c0c9dcdc9b9337e","first_seen":"2023-04-12T09:13:55Z","last_seen":"2026-09-25T08:32:44.418724Z","times_seen":276,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":27,"connect":4,"send":0,"wait":8,"receive":1,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/webpack-bb469f829a664d48.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.549Z","timestamp":1790257557549,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/webpack-bb469f829a664d48.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"891-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=Y5P8t7cKUyBlwBN.hhNJ593zUJ28zkyfSCCfeF5KUCc-1790257557.553523-1.0.1.1-eW1oBZM2JA..Gp.Go9MUSvsidhejwr00plqZEddcXVgx9NIpMuVEmOx5rsWafItHm9uIUEK4zGgHJWy4hvlDwXKJg6GsCET5ZAHOVM9gvBt_hubWGFSqIQ1W4gCpLM1s; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b8fba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"Y5P8t7cKUyBlwBN.hhNJ593zUJ28zkyfSCCfeF5KUCc-1790257557.553523-1.0.1.1-eW1oBZM2JA..Gp.Go9MUSvsidhejwr00plqZEddcXVgx9NIpMuVEmOx5rsWafItHm9uIUEK4zGgHJWy4hvlDwXKJg6GsCET5ZAHOVM9gvBt_hubWGFSqIQ1W4gCpLM1s","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=Y5P8t7cKUyBlwBN.hhNJ593zUJ28zkyfSCCfeF5KUCc-1790257557.553523-1.0.1.1-eW1oBZM2JA..Gp.Go9MUSvsidhejwr00plqZEddcXVgx9NIpMuVEmOx5rsWafItHm9uIUEK4zGgHJWy4hvlDwXKJg6GsCET5ZAHOVM9gvBt_hubWGFSqIQ1W4gCpLM1s; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":2193,"size_decoded":1917,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (2193), with no line terminators","md5":"09985188723a77d0dc96533b3177fb30","sha1":"120be09a92353d98363349d3a6459a296e2bf760","sha256":"5dfe185409ff8cc0e73ea870cbefbcdac38297bbfa69c545686e536f7c51fa64","sha512":"a2d353fda78dd8e922c37d5a555a56af304c0b836da56290a8a453da2c1665c12e59e560de474509ae42bb5602f316488987c8f49ad1d079dcb77df10e287638","ssdeep":"","tlshash":"4b410bd931e6f4d6166b7a60013f481bf02b98f2f06ca4e49354c8f13d7029a9032f9e","first_seen":"2023-03-07T01:36:05Z","last_seen":"2026-09-25T08:32:44.42433Z","times_seen":18,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/217-fc4ca4bc23c5eb89.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.555Z","timestamp":1790257557555,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/217-fc4ca4bc23c5eb89.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"33ed-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=hxcIiXXR1uz2NMy21.OAf8quzaujutItCC1u29omkyE-1790257557.5582922-1.0.1.1-3no3fa7kcRr1nQcHjFdtrJ_7CrKOjf5NAFg7oqc1NpsrqYl9bUP28A.MyRtIro7jrXy3DQcPt_5..rv_96WAzasxreWvUrkHZOV2a9nCEBa8j_A2ICmiSLE.Va4Lq2qb; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86b91ba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"hxcIiXXR1uz2NMy21.OAf8quzaujutItCC1u29omkyE-1790257557.5582922-1.0.1.1-3no3fa7kcRr1nQcHjFdtrJ_7CrKOjf5NAFg7oqc1NpsrqYl9bUP28A.MyRtIro7jrXy3DQcPt_5..rv_96WAzasxreWvUrkHZOV2a9nCEBa8j_A2ICmiSLE.Va4Lq2qb","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=hxcIiXXR1uz2NMy21.OAf8quzaujutItCC1u29omkyE-1790257557.5582922-1.0.1.1-3no3fa7kcRr1nQcHjFdtrJ_7CrKOjf5NAFg7oqc1NpsrqYl9bUP28A.MyRtIro7jrXy3DQcPt_5..rv_96WAzasxreWvUrkHZOV2a9nCEBa8j_A2ICmiSLE.Va4Lq2qb; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13293,"size_decoded":6536,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (10017)","md5":"c9ac5e786f88fe4efe5a54e23a7786ad","sha1":"14418486bbd22b01ed8d6e93b87ee08e71f34155","sha256":"1f6db8541d75dcacbef78c15894ebc5f8e5d184fb74527ce5a98d8e6a9ec3cd8","sha512":"6d6c14e26caa4bcaefe03d01135a6df9fc5f114e5d5c01edbfdb81eefdc2bffa7bb3b5eca48cc5241193abfddc47ecadb72d0764956b47a182aa8d78841db737","ssdeep":"192:0fCqtsk9qPVGKipX8v89xkvhRMoqlDfqTdba1cKVNNqwoB+K7nxD120Yi6yvn/rw:WptSOXQkuhGoqlDfiQBIX6yvzqPc8","tlshash":"4752f8a8b041b8715a9771e280bf080fb13824a531094ca5f7e6fdd85ef86a84127f9e","first_seen":"2026-09-24T00:38:51.037789Z","last_seen":"2026-09-25T08:32:44.421505Z","times_seen":10,"resource_available":true,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/995-23d4606ec37e3134.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.560Z","timestamp":1790257557560,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/995-23d4606ec37e3134.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"1df4-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=bOK2rSs9KcBok_EmDmVEXVM3E5YW3tz91IT4qmSgwug-1790257557.565071-1.0.1.1-qhg8Q_iZ51Zrbr26X1dki_Uco9zelcvXFVoTZGNXForKPlr_G9rrOpAq.SsKlLIZJtnsEniAPVy4Aq9Z_UQxZX7d4ZHAUR80OGOb8ap3SmXst.ZMPgWmfxCGpTWhjmev; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c92ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"bOK2rSs9KcBok_EmDmVEXVM3E5YW3tz91IT4qmSgwug-1790257557.565071-1.0.1.1-qhg8Q_iZ51Zrbr26X1dki_Uco9zelcvXFVoTZGNXForKPlr_G9rrOpAq.SsKlLIZJtnsEniAPVy4Aq9Z_UQxZX7d4ZHAUR80OGOb8ap3SmXst.ZMPgWmfxCGpTWhjmev","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=bOK2rSs9KcBok_EmDmVEXVM3E5YW3tz91IT4qmSgwug-1790257557.565071-1.0.1.1-qhg8Q_iZ51Zrbr26X1dki_Uco9zelcvXFVoTZGNXForKPlr_G9rrOpAq.SsKlLIZJtnsEniAPVy4Aq9Z_UQxZX7d4ZHAUR80OGOb8ap3SmXst.ZMPgWmfxCGpTWhjmev; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7668,"size_decoded":3352,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (7668), with no line terminators","md5":"fb29b5fa3b79aeeceedeb1d67ca017d5","sha1":"05de4faacdf95679f780ee00c0b1ca1d3a65e1cb","sha256":"b7e6d113c49c58b4e723329668f1adaa699eed95036a88f9c25f4db71461b8a3","sha512":"455bf398b623a7d3d07ca6e9451498529e9b570a5421a72cd6ad4bc1da9149eaf25e19577cee5cee7c4e657b80e4e78d5d55c4d213f8fcb8cd9cfe2a1a717ae1","ssdeep":"192:/xH+milOAulOgFcVlbiZl1fZDLPxXidmdnul4m7e0:krgYiZl1fZDLPxXiEnulLN","tlshash":"11f1a4a4fb80f670b96f85cc6def08d5ef7425109b5c1cbaf8a65049025f2c58463e8e","first_seen":"2026-09-24T13:46:20.531866Z","last_seen":"2026-09-25T05:51:01.006975Z","times_seen":3,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/540-a68c3ead76933934.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.564Z","timestamp":1790257557564,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/540-a68c3ead76933934.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"3a46-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=tggxz14GN4ek0LE_BuC4QmaiQ_hPZ9KbsivQU5VieEY-1790257557.566736-1.0.1.1-x65T5V3G25qz0wLde5vY15vVh3ik2i27seZC9wXJnfLEGxuKgqNZTVF1JJqoNtnDkhbMDwGVAwj5rmVrlCLh2ayfBxlU89O41vEaZpPWDMseWq._HsXYeHSW0wzpAscq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c93ea0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"tggxz14GN4ek0LE_BuC4QmaiQ_hPZ9KbsivQU5VieEY-1790257557.566736-1.0.1.1-x65T5V3G25qz0wLde5vY15vVh3ik2i27seZC9wXJnfLEGxuKgqNZTVF1JJqoNtnDkhbMDwGVAwj5rmVrlCLh2ayfBxlU89O41vEaZpPWDMseWq._HsXYeHSW0wzpAscq","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=tggxz14GN4ek0LE_BuC4QmaiQ_hPZ9KbsivQU5VieEY-1790257557.566736-1.0.1.1-x65T5V3G25qz0wLde5vY15vVh3ik2i27seZC9wXJnfLEGxuKgqNZTVF1JJqoNtnDkhbMDwGVAwj5rmVrlCLh2ayfBxlU89O41vEaZpPWDMseWq._HsXYeHSW0wzpAscq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":14918,"size_decoded":5986,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (14918), with no line terminators","md5":"31af69e34680f9c8244cc621b9d54d6c","sha1":"af2f86fe9f8ece104f9defc90b0f713c591a6994","sha256":"7c6e8a8d7d4d404770030f9a7a917fd0ab1392fe71b68f32f7f96972d0bf05fe","sha512":"c5fbaa69db3d24626a8f171685449f11cf4e0b764d507356d75aff2bc04e41715e55bd8af0282bc2381d339872d65c35697828a6f299eaf84504095912bf5dc2","ssdeep":"192:F+x+6Wu80ovRhTvFa7XYa267UKskmhM9r4Uz70rk1NnGOOAvCP3:UxEu8pvRhTvsca267UVjM9rxAI1NbLC/","tlshash":"b462e7bcebc0b8264d7bc1cdd6ef481ae66ca061a70918b5f0970d40279d2dd1627fac","first_seen":"2026-09-24T13:46:20.525194Z","last_seen":"2026-09-25T05:51:01.012329Z","times_seen":3,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/643-49ffaa237a345b9d.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.565Z","timestamp":1790257557565,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/643-49ffaa237a345b9d.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"3cc2-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=ge_d8s0LP9YvPOs2qDprCJ3.z94hKgZcDzCAk5rbdz4-1790257557.5686965-1.0.1.1-h50ssRr673vdWI8pqX1eG29XO0e0ZDWXqRYdAfiU02Why1wqRsXI50SIjUXlKHk3G.247vCoKJAAfvc7xYsnYDjC48gciKVtZfmbjNpmGyfsGvjnL8sDYF0qQiBO6vXt; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c94aa0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"ge_d8s0LP9YvPOs2qDprCJ3.z94hKgZcDzCAk5rbdz4-1790257557.5686965-1.0.1.1-h50ssRr673vdWI8pqX1eG29XO0e0ZDWXqRYdAfiU02Why1wqRsXI50SIjUXlKHk3G.247vCoKJAAfvc7xYsnYDjC48gciKVtZfmbjNpmGyfsGvjnL8sDYF0qQiBO6vXt","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=ge_d8s0LP9YvPOs2qDprCJ3.z94hKgZcDzCAk5rbdz4-1790257557.5686965-1.0.1.1-h50ssRr673vdWI8pqX1eG29XO0e0ZDWXqRYdAfiU02Why1wqRsXI50SIjUXlKHk3G.247vCoKJAAfvc7xYsnYDjC48gciKVtZfmbjNpmGyfsGvjnL8sDYF0qQiBO6vXt; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":15554,"size_decoded":6567,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (15554), with no line terminators","md5":"c355a95e04afe3e1b32dbfd458038360","sha1":"d9f67375b6d52d4060e1fe44d887f77af88744dd","sha256":"3d431fcd761bfbdc9592b3f636c8929ad8aa39ab7475122ce156158a1706dff9","sha512":"96d2f57994ac01f49f18ea87e77a9a73979a3b0553e6273fd4681ca0f275d54ced1c3ee077bd408aea90c3090c47aa7516cfe5aff141dcd46694ee0a3bb3acc5","ssdeep":"192:matg+LsetFyOo6iAhTMFSmeDogQlPmm6znQCUT4CR+EsCGSFBVHkgK40:/gHfBFS57ePmm6znBUTvQE3GSRHr0","tlshash":"4362f91aa3d8275e7906c7a4307ba50fb2cf207f72b4cb65e211fa3675118e4146abc7","first_seen":"2026-09-24T00:38:51.011382Z","last_seen":"2026-09-25T08:32:44.422905Z","times_seen":10,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/chunks/pages/login-0e179d57d6b907b1.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.567Z","timestamp":1790257557567,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/chunks/pages/login-0e179d57d6b907b1.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"49ae-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=Hddrv_baiwRb8dBJwiXRV6CDcoZQdR3HGh2AkQmOyWA-1790257557.5711808-1.0.1.1-31bnTAWKcSGmRZz3nIv3HKLfl0DMo6p2JLw0KZyh5A4pniTdaTpeM9jQv8ykNsZ2TgXQ3h.7UWZYDo5sURqyZFl5J5eX3FYSEQ1EUP2q8S1aF3x0A5x.ynCB0o1C41qq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86c953a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"Hddrv_baiwRb8dBJwiXRV6CDcoZQdR3HGh2AkQmOyWA-1790257557.5711808-1.0.1.1-31bnTAWKcSGmRZz3nIv3HKLfl0DMo6p2JLw0KZyh5A4pniTdaTpeM9jQv8ykNsZ2TgXQ3h.7UWZYDo5sURqyZFl5J5eX3FYSEQ1EUP2q8S1aF3x0A5x.ynCB0o1C41qq","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=Hddrv_baiwRb8dBJwiXRV6CDcoZQdR3HGh2AkQmOyWA-1790257557.5711808-1.0.1.1-31bnTAWKcSGmRZz3nIv3HKLfl0DMo6p2JLw0KZyh5A4pniTdaTpeM9jQv8ykNsZ2TgXQ3h.7UWZYDo5sURqyZFl5J5eX3FYSEQ1EUP2q8S1aF3x0A5x.ynCB0o1C41qq; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":18862,"size_decoded":6494,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (18862), with no line terminators","md5":"c363f021fe994ec8fa1a29659ce67038","sha1":"ed733a96ade81252ed4de4c361b79f47bc8c9567","sha256":"a8689bba1069a6fe8fbe203c2b2a980dd5aa5f2544124aa47f126aa794084976","sha512":"dc230a9f534c61938d3c2130e86905b978eb28788f60bd2ca91b1d3f14db9a66d4ed8fc2e5021d803bf7a2914e73f4a074dde870777b0b318a110c476c8bccc3","ssdeep":"384:ks3sska04Wv0ZpZI4qOqvdAsZ197L7cRWXmqOqvdAsZ197L7cRWAOOZpN8NeBr36:ks3ssdb+0Z44qOqvdAsZ197L7cRWXmqF","tlshash":"9d82e941a7a8159df403cc8861ff710eb1ef712db1d58da4bbe2ac6928568c43537bc6","first_seen":"2026-09-24T00:38:51.012921Z","last_seen":"2026-09-25T08:32:44.423537Z","times_seen":10,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.757Z","timestamp":1790257557757,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/BEYrwHpT9MOtdnX46sQSB/_ssgManifest.js HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"4c-49773873e8\"\r\nvary: Accept-Encoding\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=IMBLHGiBOOOSP9TsoGMVmC7Z35chqcLncWiLCsMk4pU-1790257557.761254-1.0.1.1-IfhhTYaIvsedjvV6bGO6_hgD.OocoaFCY6RRf.rz6QcccPk5.sJjj.KN_uziovvOCZoQq1IfE30hcJ2DbW5orLKDQLD9W.B0hz3rMQYbDLg_MpEuZhoU01yq6Rn1QegL; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncontent-encoding: br\r\ncf-ray: a4023b87fd84a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"IMBLHGiBOOOSP9TsoGMVmC7Z35chqcLncWiLCsMk4pU-1790257557.761254-1.0.1.1-IfhhTYaIvsedjvV6bGO6_hgD.OocoaFCY6RRf.rz6QcccPk5.sJjj.KN_uziovvOCZoQq1IfE30hcJ2DbW5orLKDQLD9W.B0hz3rMQYbDLg_MpEuZhoU01yq6Rn1QegL","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=IMBLHGiBOOOSP9TsoGMVmC7Z35chqcLncWiLCsMk4pU-1790257557.761254-1.0.1.1-IfhhTYaIvsedjvV6bGO6_hgD.OocoaFCY6RRf.rz6QcccPk5.sJjj.KN_uziovvOCZoQq1IfE30hcJ2DbW5orLKDQLD9W.B0hz3rMQYbDLg_MpEuZhoU01yq6Rn1QegL; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76,"size_decoded":887,"mime_type":"application/javascript; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"5352cb582146311d1540f6075d1f265e","sha1":"cbe5dad683f4f887122db6f6d343aa8ba41dee8b","sha256":"e182e3257a3b5564f7bfb9fb1c6a1e13f8f7c9a3fa0dd6e39ccf473ef8d4f960","sha512":"50b05ff9c7703a5997b538c02a177a32bc91ce03de33779039fe5f1eccb1d2b8f04735a24cad024999c0c937160d3fce66a9b1c114a5b8e95e8c11afcff59654","ssdeep":"","tlshash":"a4a001e0943cdc60aa63dd1c136413128fa05122651d28938afd3044c0301510300d90","first_seen":"2023-03-07T01:19:07Z","last_seen":"2026-09-25T08:32:44.425501Z","times_seen":667,"resource_available":true,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www10.wellsfargomedia.com/auth/static/images/COB-BOB-IRT-enroll_tractor.jpg","fqdn":"www10.wellsfargomedia.com","domain":"wellsfargomedia.com","tld":"com"},"ip":{"addr":"23.52.23.95","port":443,"asn":16625,"as":"AKAMAI-AS","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.791Z","timestamp":1790257557791,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www10.wellsfargomedia.com","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 07 Oct 2025 00:00:00 GMT","end":"Thu, 08 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:51:72:B8:FA:94:2B:FE:9F:B4:1F:BC:6B:6F:0E:D8:D1:1C:2A:63","sha256":"DF:16:89:32:0F:23:BD:46:7A:ED:B4:28:DB:28:F3:A2:7E:BF:A7:CA:C1:56:AF:96:23:16:D2:D5:07:D7:69:A2"}}},"request":{"raw":"GET /auth/static/images/COB-BOB-IRT-enroll_tractor.jpg HTTP/1.1\r\nHost: www10.wellsfargomedia.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccess-control-allow-methods: POST\r\nlast-modified: Mon, 10 Aug 2026 05:38:27 GMT\r\nx-frame-options: SAMEORIGIN\r\netag: \"6a75d2e8-95bb8\"\r\ncontent-security-policy: default-src 'self'; script-src 'self'; object-src 'self'; frame-ancestors 'self'; report-uri https://ort.wellsfargo.com/securereporting/reporting/v1/csp\r\nserver: Akamai Image Manager\r\ncontent-length: 507666\r\ncontent-type: image/avif\r\ncache-control: private, no-transform, max-age=2592000\r\nexpires: Sat, 24 Oct 2026 13:45:57 GMT\r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":507666,"size_decoded":508227,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"a8dfffcb87726ac8bc9ca4025839d41a","sha1":"eb1b20c10b0026dfd5d9f9c9ab56f1a82c3c6135","sha256":"5dace8618159bbaee39b802658dc20e8a6391e892453a3edbeadf5e7cd14091d","sha512":"d74e1e8ecae0c46485eee52a17e918abe5eeb221877bac724fadf7331298afa08b865e0ef083fc7d892bb0725768fc847db806db682bd09d69b9531b48e98ed0","ssdeep":"12288:QmJWnYDtrwdtw7HOCPkNK6LGANMVb6x5dxw2HpbSWlZET4wTIT:ZWnYhrEwgXNMRIdxjSWYtu","tlshash":"6fb423841f22796cb9ee190b3151cd98f44ebacb2ee89d3c60d624de30727191fe6457","first_seen":"2026-08-14T00:27:47.337395Z","last_seen":"2026-09-25T08:32:44.416042Z","times_seen":9,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":38,"connect":25,"send":0,"wait":28,"receive":98,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-24T13:45:56.846Z","timestamp":1790257556846,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 307 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncache-control: private, no-cache, no-store, max-age=0, must-revalidate\r\nlocation: /login\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 307\r\nserver: cloudflare\r\npriority: u=0,i\r\ncf-cache-status: BYPASS\r\nset-cookie: __cf_bm=BqfFNOk2dk04K7GKHKaDGDW4ic.6yxVjlWQQ4FXFXS4-1790257556.8725772-1.0.1.1-MhRojN7oNQ4ufZWFiLZPoJQ4ugm9RTmdACouH9q0YKM7uxO2226WBd5Z.qI3AW78sU1WAgkbQmOH9YBKcF3bE5v62R6Xq4cM9uUPOQdoH0aXpqeGxY.6srO1tpyiCKkQ; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b8278f9a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"BqfFNOk2dk04K7GKHKaDGDW4ic.6yxVjlWQQ4FXFXS4-1790257556.8725772-1.0.1.1-MhRojN7oNQ4ufZWFiLZPoJQ4ugm9RTmdACouH9q0YKM7uxO2226WBd5Z.qI3AW78sU1WAgkbQmOH9YBKcF3bE5v62R6Xq4cM9uUPOQdoH0aXpqeGxY.6srO1tpyiCKkQ","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=BqfFNOk2dk04K7GKHKaDGDW4ic.6yxVjlWQQ4FXFXS4-1790257556.8725772-1.0.1.1-MhRojN7oNQ4ufZWFiLZPoJQ4ugm9RTmdACouH9q0YKM7uxO2226WBd5Z.qI3AW78sU1WAgkbQmOH9YBKcF3bE5v62R6Xq4cM9uUPOQdoH0aXpqeGxY.6srO1tpyiCKkQ; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-25T13:27:32.214499Z","times_seen":18652212,"resource_available":true,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":5,"connect":14,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/login","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-24T13:45:57.075Z","timestamp":1790257557075,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: text/html; charset=utf-8\r\nx-powered-by: Next.js\r\nvary: Accept-Encoding\r\nset-cookie: __cf_bm=JtgP3i_jgVYzW5gjY1.Ucf8dGaJRRX02e8RZofOqfFo-1790257557.077811-1.0.1.1-lxK4ZNUxBQyOkoIIFUgC1W7yKQScsvG5ig1lSsnlDVCqI335B38QsIvOFGJKc8AtAGoAIqihWkSqAmPSTRVmLzKwO799FBNASC7BXLH1KRd302B5YzsXrUvAhsv65r2b; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\ncache-control: private\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=0,i\r\ncf-cache-status: BYPASS\r\ncontent-encoding: br\r\ncf-ray: a4023b83bda2a0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"JtgP3i_jgVYzW5gjY1.Ucf8dGaJRRX02e8RZofOqfFo-1790257557.077811-1.0.1.1-lxK4ZNUxBQyOkoIIFUgC1W7yKQScsvG5ig1lSsnlDVCqI335B38QsIvOFGJKc8AtAGoAIqihWkSqAmPSTRVmLzKwO799FBNASC7BXLH1KRd302B5YzsXrUvAhsv65r2b","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=JtgP3i_jgVYzW5gjY1.Ucf8dGaJRRX02e8RZofOqfFo-1790257557.077811-1.0.1.1-lxK4ZNUxBQyOkoIIFUgC1W7yKQScsvG5ig1lSsnlDVCqI335B38QsIvOFGJKc8AtAGoAIqihWkSqAmPSTRVmLzKwO799FBNASC7BXLH1KRd302B5YzsXrUvAhsv65r2b; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Next.js","description":"Next.js is a React framework for developing single page Javascript applications.","website":"https://nextjs.org","common_platform_enumeration":"cpe:2.3:a:zeit:next.js:*:*:*:*:*:*:*:*","icon":"Next.js.svg","categories":["JavaScript frameworks","Web frameworks"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]},{"name":"Webpack","description":"Webpack is an open-source JavaScript module bundler.","website":"https://webpack.js.org/","common_platform_enumeration":"","icon":"Webpack.svg","categories":["Miscellaneous"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76075,"size_decoded":12582,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"cfec065d235804fcc2fb59948dc566f7","sha1":"069fad0bf5183a594f62d9b1b1569d834c120984","sha256":"32fbade2a7a52bc2644db4c80423acbb11f1e20bbe80cf3d64d245c2a1ae327c","sha512":"e1f2f2c0221c9b8835d21b0b23df17c47a1807973c5f42e5f711a2db49e2ae8c5055f45b4ef3bfbbd57aaccf8b27a7d6e2284ba05ec78b0d57b72aade96738d3","ssdeep":"768:wz+37Hu5k5xLlmm6FUTlOGM9WEC9J2LbiWAIHS0W/l8jLMKgmedE4aWGsr4fRlzT:w67Hu5k5dlmtAmeH0E5GopFjMOw","tlshash":"7273ec3787d1133c6007ce9f5bd5a946517ae817e422bbe9b9634522cbcb6c24a6330f","first_seen":"2026-09-24T13:46:20.536604Z","last_seen":"2026-09-25T05:51:01.009458Z","times_seen":3,"resource_available":true,"data":null}},"time_used":237,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":237,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"auth-app-ajba9.ondigitalocean.app/_next/static/css/ec70bd28c3629d55.css","fqdn":"auth-app-ajba9.ondigitalocean.app","domain":"auth-app-ajba9.ondigitalocean.app","tld":"ondigitalocean.app"},"ip":{"addr":"162.159.140.98","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://auth-app-ajba9.ondigitalocean.app/login","date":"2026-09-24T13:45:57.547Z","timestamp":1790257557547,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ondigitalocean.app","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 23 Sep 2026 04:05:23 GMT","end":"Tue, 22 Dec 2026 05:05:20 GMT"},"fingerprint":{"sha1":"8B:3B:8B:9B:9E:62:3D:61:0A:14:CC:B9:CA:67:CA:D9:0D:A9:56:1C","sha256":"6E:E6:51:86:E8:65:1E:E2:59:59:E8:79:F2:FA:BC:24:A2:B3:78:BB:9A:4F:EF:4C:EE:CA:34:0F:C5:09:63:31"}}},"request":{"raw":"GET /_next/static/css/ec70bd28c3629d55.css HTTP/1.1\r\nHost: auth-app-ajba9.ondigitalocean.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://auth-app-ajba9.ondigitalocean.app/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 24 Sep 2026 13:45:57 GMT\r\ncontent-type: text/css; charset=UTF-8\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nlast-modified: Tue, 01 Jan 1980 00:00:01 GMT\r\netag: W/\"23bd-49773873e8\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nage: 68773\r\nx-do-app-origin: 74150bef-fdb5-40ce-a6cc-c4e661b9c004\r\nx-do-orig-status: 200\r\nserver: cloudflare\r\npriority: u=0,i=?0\r\ncf-cache-status: HIT\r\nset-cookie: __cf_bm=BVzRmJcJ3422I4wfJcQM_QTb7rAgP8KRZm.DS1DO0j4-1790257557.551718-1.0.1.1-Qnjy83PsImbtpEh7cb50ok2K9hsnNDyfXZpgT095Usyeq9s35.nK0k51qHbrtuxHxSMDz7LZRCfBZVPUf0_iPw0gn8q3lQpofDOIZdI.JXjYd5i7I7o3ZYCsCNetNH1N; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT\r\ncf-ray: a4023b86a8eba0f0-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"__cf_bm","value":"BVzRmJcJ3422I4wfJcQM_QTb7rAgP8KRZm.DS1DO0j4-1790257557.551718-1.0.1.1-Qnjy83PsImbtpEh7cb50ok2K9hsnNDyfXZpgT095Usyeq9s35.nK0k51qHbrtuxHxSMDz7LZRCfBZVPUf0_iPw0gn8q3lQpofDOIZdI.JXjYd5i7I7o3ZYCsCNetNH1N","quoted":false,"path":"/","domain":"ondigitalocean.app","expires":"2026-09-24T14:15:57Z","raw_expires":"Thu, 24 Sep 2026 14:15:57 GMT","secure":true,"http_only":true,"same_site":"None","partitioned":false,"raw":"__cf_bm=BVzRmJcJ3422I4wfJcQM_QTb7rAgP8KRZm.DS1DO0j4-1790257557.551718-1.0.1.1-Qnjy83PsImbtpEh7cb50ok2K9hsnNDyfXZpgT095Usyeq9s35.nK0k51qHbrtuxHxSMDz7LZRCfBZVPUf0_iPw0gn8q3lQpofDOIZdI.JXjYd5i7I7o3ZYCsCNetNH1N; HttpOnly; SameSite=None; Secure; Path=/; Domain=ondigitalocean.app; Expires=Thu, 24 Sep 2026 14:15:57 GMT"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9149,"size_decoded":1838,"mime_type":"text/css; charset=UTF-8","magic":"ASCII text, with very long lines (9149), with no line terminators","md5":"ec0b8850fd294a499a073697700451dd","sha1":"ff2a49e971352b1ab3c13b93cb843e3f1034672a","sha256":"b4d49ad903ce6450f2f54efba11e4f2c7f5a6148acc0c2bd40e0d7f853f118f8","sha512":"40e211e8743dd99a7284e137ea56cfb3b9b023134faf9385277844ddcb5386ecf2198a974cb9f9ef63343c29d4d24e10a220f1d7f3315c5d61d109f6a5a5929b","ssdeep":"192:2VZvPsbGQNaUeb3K79C3URJK9Rvg762tpDd6LEAq:/b","tlshash":"c012bbb24a0662d28d23cd83f5db75115c1f601eb4850897e37e5eaa1df342a46e0f7e","first_seen":"2026-09-24T00:38:51.030157Z","last_seen":"2026-09-25T08:32:44.420433Z","times_seen":10,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-24","alert":"Phishing Block","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-24","alert":"Sinkholed","trigger":"auth-app-ajba9.ondigitalocean.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Wells Fargo","verdict":"phishing","severity":"medium","comment":"Assest commenly seen with Wells Fargo phishing","tags":["wellsfargo","financial","phishing"],"meta":null}]}}]}