{"report_id":"fba3f124-5098-4c6e-ac84-a45b5423c0ac","version":6,"status":"done","tags":[],"date":"2026-02-27T06:07:59Z","url":{"schema":"http","addr":"postfinance.actions.atwork.ai","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":0,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"title":"atwork AI Action Suggestion","dom":{"size":8448,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (6149)","md5":"bb8bc158ffaeaf5d6eec13a2c5b7612c","sha1":"1f2e87a0e9a26a365134ebd5d6b8030527a60de0","sha256":"c9b00c08669853932fc1f03f2adf19db3ff2c462a67d543e8e7d6734ac63e5af","sha512":"9f3884e8857b5f07ba396204d088cb62a771b3e4e0416411a7b3e104c1656dc75a5bd1571ae21e4f73d3a86378c78d34f518969dc55e8a2ba63ff3798d108acc","ssdeep":"96:nm08wn6SKUa7R/VEhrgeXnw/JhR33iBnqETALNhnsvvgW1vvdFKReoVkpHVvShT4:mPvSYR/VEhrXw/J7iB8evbvRVZFqET","tlshash":"1c02731bf10238ad23278bcee4a0bb6ba0f7d55bdb55048419bcc6552fcce71aa17b41","dom_hash":"domhash83c4abcb4ef76d660671caf08417e9ec","first_seen":"2026-02-27T06:08:07.53901Z","last_seen":"2026-02-27T06:08:07.53901Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"postfinance.actions.atwork.ai","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":0,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-03T06:07:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"postfinance.actions.atwork.ai","ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-02-27T06:08:02.756154Z","last_seen":"2026-02-27T06:08:02.756154Z","alert_count":52,"request_count":13,"received_data":4781536,"sent_data":6981,"comment":"","tags":null,"fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}]},{"fqdn":"cdn.segment.com","ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"1998-07-06","domain_rank":9348,"first_seen":"2014-04-11T12:30:48Z","last_seen":"2026-02-25T16:09:11.470117Z","alert_count":0,"request_count":4,"received_data":124789,"sent_data":1968,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2026-02-23T06:27:16.921756Z","alert_count":0,"request_count":2,"received_data":14694,"sent_data":1057,"comment":"","tags":null,"fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.1b218d13fed021531d4e.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"409caee2a9c8f0a6aba854d05642d2bc","sha1":"8a82603bb351a4356e612d8b2e8ba0d6c202c466","sha256":"740f4d03a4a3b214202a9cca049ba2cdfafe0573a7882f2c99cd009c436ab70d","sha512":"9682edf819a9237420550ca4867507c5ff1ac705c5a663787e7cb92f7f9b21fc4b4f5e295eb81982f65f97788c620ac2b6907f81a52a373eb6773362c214c83d","ssdeep":"","tlshash":"c0313fc979d1fa4415bb1cb2c4bfa01fb33dfc96106f8052f052cca0282928d9623d25","size":1559,"data":"","first_seen":"2025-04-24T21:35:05.034052Z","last_seen":"2026-08-12T20:06:40.259731Z","times_seen":17555,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/9656.8c935274.chunk.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"97306efdcb790815e8c030813fed8cc5","sha1":"c27a214d38657d877982a39b01e4c43d1fbcd8fe","sha256":"dd507a353d04404ac9517d9260b42998d029d7db16238e406cd3902d58dcbc82","sha512":"959d6481cac69cc24ea40bc9c264aa82e5350de22c85f6d99ac956c90709568b628aa36cf1dc44da0b8a442a26653ecf9cd8ac0728d505059ff2a0a9a23dd36d","ssdeep":"384:gnCTErCGlCflKr9DJ/T1rNKi6a3nFzprxTrzdNzAQAC:gnCgrCGlCfkprN/6QrzdaQ9","tlshash":"37a21ad472d1f05a3673e0bca0af4546f27b766db06c5a41b32698e02db215da331f3a","size":22113,"data":"","first_seen":"2024-04-10T21:15:18Z","last_seen":"2026-07-15T23:51:24.759245Z","times_seen":15,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/8691.ee84f70b.chunk.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"2331618a595829f2089acbb7e607f90e","sha1":"08e220562db3913d0c5f6bb926bfcb0b210cc841","sha256":"26424a60d94c4dd79766d236fd72f52fd0f211799533c5d2533754b1afc75dd6","sha512":"b468a55a7ffd4da6e49a497a5161ad0ceb5f07b6b6c5ddb61b80aa5bf98fca85ab4fa42d81e6282ef6885711a0a9f65efaf3502f50040a2ba343373bc03ad442","ssdeep":"192:AY96jTJ0fpudNn2NFY+aQKWHQQC5mD7CphqTO6S70W0BUY:AY96jT+eNnIrhKECvqTPb1BUY","tlshash":"4922d68472e2f07417ea849dc46f520af225ba1ee10dc0d0f63ad8e868f59cb5167f39","size":10248,"data":"","first_seen":"2026-02-27T00:42:31.784285Z","last_seen":"2026-05-03T14:18:01.585468Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"20faf8e9200f1f88b33405b9b8dd8468","sha1":"0849bffe35078d38ca2f55dda5a4d62fa3c12ca0","sha256":"16f10a82134b3f4633c99480c673cab97ba77dca5325f9b8fd3baefe3f6e051c","sha512":"8a1c3111b22cc13203ec44173f85c58a7c7c6bf96d5020f6481f3fba46ceb397e22f45f583813d853f55f3727f37303e7fcc0fc9d44a4424836c2cdd9c803ee5","ssdeep":"","tlshash":"8f70002208282c88003000a082022e022002008220a802220a800c0a380a223202c2e8","size":24,"data":"","first_seen":"2023-03-07T12:07:11Z","last_seen":"2026-08-09T13:35:32.756304Z","times_seen":354,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"eval","is_inline":false,"md5":"f0ffd3b7c2574ac324603ed00488c850","sha1":"623e76c36aa2a886542011e28412cc761d7ceb01","sha256":"c4d0cf241a1bfa1c8bf4cf24e8f89d2ab786a284a39adb2fc8df7ea14e73c154","sha512":"436f9fb4816f6975fec0d965dfc0db4c3c38c53632dd4dc99a6c1a2dd9562fbd67176d0118549ff573c97e3394bad4d601c425cf670acab249ebc8d260591fa2","ssdeep":"","tlshash":"1540000003c00000300000c0000000000003c00000000000c000000000c00000300030","size":7,"data":"","first_seen":"2023-03-07T01:03:35Z","last_seen":"2026-08-12T22:51:16.123379Z","times_seen":83671,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"eval","is_inline":false,"md5":"f0ffd3b7c2574ac324603ed00488c850","sha1":"623e76c36aa2a886542011e28412cc761d7ceb01","sha256":"c4d0cf241a1bfa1c8bf4cf24e8f89d2ab786a284a39adb2fc8df7ea14e73c154","sha512":"436f9fb4816f6975fec0d965dfc0db4c3c38c53632dd4dc99a6c1a2dd9562fbd67176d0118549ff573c97e3394bad4d601c425cf670acab249ebc8d260591fa2","ssdeep":"","tlshash":"1540000003c00000300000c0000000000003c00000000000c000000000c00000300030","size":7,"data":"","first_seen":"2023-03-07T01:03:35Z","last_seen":"2026-08-12T22:51:16.123379Z","times_seen":83671,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"eval","is_inline":false,"md5":"f0ffd3b7c2574ac324603ed00488c850","sha1":"623e76c36aa2a886542011e28412cc761d7ceb01","sha256":"c4d0cf241a1bfa1c8bf4cf24e8f89d2ab786a284a39adb2fc8df7ea14e73c154","sha512":"436f9fb4816f6975fec0d965dfc0db4c3c38c53632dd4dc99a6c1a2dd9562fbd67176d0118549ff573c97e3394bad4d601c425cf670acab249ebc8d260591fa2","ssdeep":"","tlshash":"1540000003c00000300000c0000000000003c00000000000c000000000c00000300030","size":7,"data":"","first_seen":"2023-03-07T01:03:35Z","last_seen":"2026-08-12T22:51:16.123379Z","times_seen":83671,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"eval","is_inline":false,"md5":"f0ffd3b7c2574ac324603ed00488c850","sha1":"623e76c36aa2a886542011e28412cc761d7ceb01","sha256":"c4d0cf241a1bfa1c8bf4cf24e8f89d2ab786a284a39adb2fc8df7ea14e73c154","sha512":"436f9fb4816f6975fec0d965dfc0db4c3c38c53632dd4dc99a6c1a2dd9562fbd67176d0118549ff573c97e3394bad4d601c425cf670acab249ebc8d260591fa2","ssdeep":"","tlshash":"1540000003c00000300000c0000000000003c00000000000c000000000c00000300030","size":7,"data":"","first_seen":"2023-03-07T01:03:35Z","last_seen":"2026-08-12T22:51:16.123379Z","times_seen":83671,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/main.ca9076db.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":false,"md5":"0bb10b4a1b83c6251e1defcbafb381e7","sha1":"3605da0b4825a0f9431b2fbb0c98c26202bdd5b6","sha256":"8f2819c06da1b5d9d0548aebce535c126c2a4cfce2bbd507409f4e5715e90ba4","sha512":"b5c8b42fd9f569623276da7f99cee55acc7a237c002bfdeda74887d13819ab68f986969499ac49910d1cefddd3a8002bbd05598987574be862cf7ec09588b9e5","ssdeep":"49152:uD70NIJ81MrpQZN0wRKMXIqAyVLRpWQ7zNPVffEi24tqGxFL4OdRhGPgiXViX:uD4Sor08V24tqGxFL4OdTiFC","tlshash":"bf160958366af7409559c0c7e8372c45d2add58ab00b50e0bfb487f31ab1743e6aee27","size":4408075,"data":"","first_seen":"2026-02-27T06:08:07.562464Z","last_seen":"2026-02-27T13:06:51.578249Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/analytics.js/v1/iCkMy7ymtJ9qYzQRXkQpnAJEq7D4NyMU/analytics.min.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5bab93260bd369652f206725ab3aa1cf","sha1":"4b14d613589c68d2264c7316646c810688341040","sha256":"221d24137c91bde35da1a4475663174a99d785fc5d3b6683b13c5996d06a0c46","sha512":"86b4a3def6d543275a3d39550b68de96fa9ce20cc8c943e399862fcfaa100495d95924dbe422b210c9e7e11d663e0161fd14f06af397f8e43a04611f514bb951","ssdeep":"768:IAObYQP9MBThbyDRP0aubWc+ZdLyiQL96+hYs17eFCgt/oJBpntD/PN/xd0MpIJ4:TQP9MtMZ+vCBF/g0vmBuNfftrcuk","tlshash":"36b371c8f6d6f064439764b4803f510bf23eb96e680e8464f266dad26c7899d9133f78","size":108916,"data":"","first_seen":"2025-06-30T08:42:35.936454Z","last_seen":"2026-05-20T13:43:34.897115Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.8e6b895db75187c55313.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e684181e935c8e5edbb28158b32e8b5b","sha1":"00c3a156bb39037c9924366ed626207ae4da054d","sha256":"7917f7349d28ce1e56706c4ce983b4ec809994c991d4d8c4fddebcf1d8b4600b","sha512":"cbb6facd90685c6bc5d3f11f1d9d97dcb4f52f941291ecd58a99ae650848e03c9fe2c80980b2916ef53bb995e7246467b57fbd37ae176185879744a0c1a7ec5d","ssdeep":"96:jJeT6TTVShwEsmEMNJexHJrmUnMKH8z3FzunS5jbr5JGIhnilIX+XPhl0rjLy:o6TBewEsmXexptnMJVunK5IU3X3y","tlshash":"651240cdf6c7f51a5167bab4907b001a733bbc2a204e0854f12bcdd62879659a13bf78","size":9273,"data":"","first_seen":"2025-04-24T21:35:04.954972Z","last_seen":"2026-08-12T20:06:40.301774Z","times_seen":17569,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"wss","addr":"postfinance.actions.atwork.ai/_stcore/stream","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:39.969Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /_stcore/stream HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://postfinance.actions.atwork.ai\r\nSec-WebSocket-Protocol: streamlit, PLACEHOLDER_AUTH_TOKEN\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: zpA9/AAZ02oknO7PG9skfg==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nDate: Fri, 27 Feb 2026 06:07:40 GMT\r\nServer: TornadoServer/6.4\r\nSet-Cookie: _xsrf=2|2f063928|36c7f758eda1e604b58111f7726d441f|1772172460; Path=/\r\nUpgrade: websocket\r\nVary: Accept-Encoding\r\nSec-WebSocket-Protocol: streamlit\r\nSec-WebSocket-Accept: YToM7sVfvjtWcRrCdM6hK1Qx05A=\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T22:54:03.779504Z","times_seen":17861910,"resource_available":true,"data":null}},"time_used":78,"timings":{"blocked":0,"dns":1,"connect":18,"send":0,"wait":24,"receive":0,"ssl":35},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/v1/projects/iCkMy7ymtJ9qYzQRXkQpnAJEq7D4NyMU/settings","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.245Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.segment.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 16 Sep 2025 00:00:00 GMT","end":"Thu, 15 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"90:3F:7C:B8:04:2E:CD:A4:E1:F1:8C:5D:DB:17:18:85:E6:C0:E9:98","sha256":"18:9C:5C:43:17:4C:C1:EA:72:5A:8E:DD:37:64:4C:DF:83:99:F4:51:8E:85:20:61:7F:A0:40:01:DC:6F:65:43"}}},"request":{"raw":"GET /v1/projects/iCkMy7ymtJ9qYzQRXkQpnAJEq7D4NyMU/settings HTTP/1.1\r\nHost: cdn.segment.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance.actions.atwork.ai/\r\nOrigin: https://postfinance.actions.atwork.ai\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/json; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-max-age: 3000\r\nx-amz-replication-status: COMPLETED\r\nlast-modified: Tue, 17 Feb 2026 06:46:59 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 0Q5mUVI3GOGPtUnPDyFVRC_xJaJfoyMB\r\ncontent-encoding: gzip\r\ndate: Fri, 27 Feb 2026 03:32:13 GMT\r\ncache-control: public, max-age=10800\r\netag: W/\"d7ba73fe7149774d95bc732a2403eeca\"\r\nvary: accept-encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 e6b6fb416c0f8841679973bf6325a4a4.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: a2I77RfNTS-r5Afvozcxs3DBR64UYPaGFZhIWc01e0BIJUelgHk8OA==\r\nage: 9387\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":2034,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"d7ba73fe7149774d95bc732a2403eeca","sha1":"7cbb3b2d9bde3b35806e505706d4882f257f2bc2","sha256":"46224007c75d756ec18cd77a72bd64ba9347ffd16ca7cfa893ad09d661164354","sha512":"52031ade1055b0163d8af279976108db6863762f0323eb8c5b3df63efdc46b20429245aea8dc4743da209fca2806b2b54b367123d656a205c18d673a7aab1b8f","ssdeep":"","tlshash":"7241de4d2411b5f6484ace2aea797e038671ddb515c33064e2fdc60c01fbd9c4356e13","first_seen":"2026-02-27T00:42:31.792522Z","last_seen":"2026-03-01T21:45:26.763736Z","times_seen":4,"resource_available":false,"data":null}},"time_used":55,"timings":{"blocked":23,"dns":1,"connect":8,"send":0,"wait":9,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/main.ca9076db.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:38.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/js/main.ca9076db.js HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/javascript\r\nDate: Fri, 27 Feb 2026 06:07:38 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nContent-Encoding: gzip\r\nETag: \"b5c8b42fd9f569623276da7f99cee55acc7a237c002bfdeda74887d13819ab68f986969499ac49910d1cefddd3a8002bbd05598987574be862cf7ec09588b9e5\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nTransfer-Encoding: chunked\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":4408075,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"333c42ab97d4ba3f1d55aac781c490a7","sha1":"e78d32182a880d8267c2f0c24e0316755e47bae9","sha256":"e5c88f327dc3c1c2839668da57a22b6c46813a87e0871acec0b866a193045d29","sha512":"ee9bc4c861fbdd88f9ecfdc93b498e243af8acf5d22b4e56e2df8ed7bf04577674e1099e179634c7bcdb988f1067f692f2a5805d2226273e581ab28fed1b680d","ssdeep":"12288:uD705TLIJ81Mr3InFn9g55FvXWaRe/RNZmxlv8XGfK:uD70NIJ81MrpFvXhReZNZmxlv8XGfK","tlshash":"2d255b953790f8a163a781d6103b240bf33db99d741d80a8f3b8d9e678a89875137b3d","first_seen":"2026-02-27T00:42:31.787925Z","last_seen":"2026-02-27T13:06:51.562209Z","times_seen":3,"resource_available":false,"data":null}},"time_used":723,"timings":{"blocked":82,"dns":1,"connect":21,"send":0,"wait":51,"receive":498,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/css/main.77d1c464.css","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:38.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/css/main.77d1c464.css HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/css\r\nDate: Fri, 27 Feb 2026 06:07:38 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nContent-Encoding: gzip\r\nETag: \"fa665207e68cc542330d7c62c3456f7b1aae51fea576aded3a37d83195e8776e5779804976de148d74b09d74466a0f161c24e91a2708853a68c272a3d5f7c93a\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nTransfer-Encoding: chunked\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":28963,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (28963), with no line terminators","md5":"f326d215d70294fabe2ee29aa8c3e4b6","sha1":"bb2ee040a8bfc27f14c19c5f17a6d8631071d45f","sha256":"8101415df9b4e08bb0d720df7a81fb7c7a4cf0947793895e337ac8c79f9ce42f","sha512":"fa665207e68cc542330d7c62c3456f7b1aae51fea576aded3a37d83195e8776e5779804976de148d74b09d74466a0f161c24e91a2708853a68c272a3d5f7c93a","ssdeep":"384:nrW80ckMPgefBEA4LiqRd2s3cnNU5o5OjMA:nD0L5o58","tlshash":"99d2cf0bb39a6a13b4194d29708b17b06d452e1cf221c913e5add6b18cd6c7f069ebfc","first_seen":"2023-10-23T21:49:31Z","last_seen":"2026-07-15T13:58:05.634623Z","times_seen":17,"resource_available":false,"data":null}},"time_used":128,"timings":{"blocked":43,"dns":0,"connect":22,"send":0,"wait":32,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/_stcore/host-config","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:39.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /_stcore/host-config HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 602\r\nContent-Type: application/json; charset=UTF-8\r\nDate: Fri, 27 Feb 2026 06:07:39 GMT\r\nServer: TornadoServer/6.4\r\nCache-Control: no-cache\r\nETag: \"424c1374190adc0691e1c6bb0ac69b006da770ee\"\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":602,"size_decoded":0,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"4b56f5aff337dcd70fff62ca094664cd","sha1":"424c1374190adc0691e1c6bb0ac69b006da770ee","sha256":"edd16e00a24584ebe8be9ac27120716e6409f09e41f13f0bde5913b0c43a291d","sha512":"f0d4e950d15b436e7da211ac8190bc944b660373d40b7919771f26efdf5f76a13668a29461fab530ffbb4ecf56aa34aa1f81d14b5e372cdfe3ba75c8a54e91a0","ssdeep":"","tlshash":"59f092e3525407bf73e892ebb82f7e4ef3d7814f0ec5450ad524d412221d9b916aab12","first_seen":"2023-11-27T17:01:18Z","last_seen":"2026-07-15T13:58:05.646106Z","times_seen":16,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/media/SourceSansPro-SemiBold.abed79cd0df1827e18cf.woff2","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/media/SourceSansPro-SemiBold.abed79cd0df1827e18cf.woff2 HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/static/css/main.77d1c464.css\r\nCookie: _xsrf=2|2f063928|36c7f758eda1e604b58111f7726d441f|1772172460\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 77452\r\nContent-Type: application/octet-stream\r\nDate: Fri, 27 Feb 2026 06:07:40 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nETag: \"0f7e1d597fdb820bb2e3c5769e038b651b7297aefc33ac57a062618d861db1da9b0cf5e367c306d9e0e68ab80653f5934c9aba4c653faf1acfe8b326496faa98\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":77452,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 77452, version 2.2949","md5":"a0a70ab999f79c3e116011820ebef9ac","sha1":"81cf6d2100f16790beae09eef512a1aac6adcd9e","sha256":"ddb65d837359b3f8395523f3e6e3609215c5e53941e9b3f572a63b8e524a4016","sha512":"0f7e1d597fdb820bb2e3c5769e038b651b7297aefc33ac57a062618d861db1da9b0cf5e367c306d9e0e68ab80653f5934c9aba4c653faf1acfe8b326496faa98","ssdeep":"1536:v96fbF/K8eGYIIZNOw0wOScaSYTtaEdmt8/AFJicGGpE58g4jf:l6fbnIZ3kSLxr/AFJM78gWf","tlshash":"827312b271311465df0345a893d8cf1f7a61bb5de3e9814ba1a21873fc488051afa6ec","first_seen":"2023-10-23T21:49:31Z","last_seen":"2026-07-21T02:01:42.027735Z","times_seen":90,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":501,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/media/SourceSerifPro-SemiBold.5c1d378dd5990ef334ca.woff2","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:38.139Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/media/SourceSerifPro-SemiBold.5c1d378dd5990ef334ca.woff2 HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance.actions.atwork.ai/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 72668\r\nContent-Type: application/octet-stream\r\nDate: Fri, 27 Feb 2026 06:07:38 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nETag: \"714193b4c67aff05d2fc9731b99edecec087320bdd2b8190eded71743391cf4aa6c312ac9d9a5c6082f8014d288a41d7421981390823858bf82cc63236daf841\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":72668,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 72668, version 2.655","md5":"6ca3de6439ae1573a213a879ca1b2280","sha1":"aa714fd3d769c9adb38fe9b99708f5c0763005ea","sha256":"e917f69981773aef057cc68806bc03a355660058b6031bbd9ef4bfeb6325b7b1","sha512":"714193b4c67aff05d2fc9731b99edecec087320bdd2b8190eded71743391cf4aa6c312ac9d9a5c6082f8014d288a41d7421981390823858bf82cc63236daf841","ssdeep":"1536:rrP6ev+A4CQGxaHfLbjQC7VIyPPlmClyf+CwJXQ5CV0w725Mhm3y0Q:rrPzWA49f/LbkCh/EClypwpV2s25Mhma","tlshash":"036302a0221b798fc26c20e618e9c5b771a2f494b69c0396d5f74d842278ee3771ced5","first_seen":"2023-10-23T21:49:31Z","last_seen":"2026-07-15T13:58:05.63346Z","times_seen":14,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":46,"dns":1,"connect":19,"send":0,"wait":34,"receive":37,"ssl":31},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.8e6b895db75187c55313.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.segment.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 16 Sep 2025 00:00:00 GMT","end":"Thu, 15 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"90:3F:7C:B8:04:2E:CD:A4:E1:F1:8C:5D:DB:17:18:85:E6:C0:E9:98","sha256":"18:9C:5C:43:17:4C:C1:EA:72:5A:8E:DD:37:64:4C:DF:83:99:F4:51:8E:85:20:61:7F:A0:40:01:DC:6F:65:43"}}},"request":{"raw":"GET /analytics-next/bundles/ajs-destination.bundle.8e6b895db75187c55313.js HTTP/1.1\r\nHost: cdn.segment.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ndate: Wed, 12 Mar 2025 15:21:48 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-max-age: 3000\r\nx-amz-replication-status: COMPLETED\r\nlast-modified: Tue, 11 Mar 2025 23:36:37 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=31536000,immutable\r\nx-amz-version-id: 1eqaMDIVNNwdECi2iQtLkKZVDluCgGzM\r\ncontent-encoding: br\r\netag: W/\"e684181e935c8e5edbb28158b32e8b5b\"\r\nvary: accept-encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 b78539d5f13f3162976a6abc8783d3de.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: CGYYIw9zCw453WH8K69T0WCWSNoYFH3ZCDD5FXiAE7HZTuDLDe0DaA==\r\nage: 30379552\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":9273,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9201)","md5":"e684181e935c8e5edbb28158b32e8b5b","sha1":"00c3a156bb39037c9924366ed626207ae4da054d","sha256":"7917f7349d28ce1e56706c4ce983b4ec809994c991d4d8c4fddebcf1d8b4600b","sha512":"cbb6facd90685c6bc5d3f11f1d9d97dcb4f52f941291ecd58a99ae650848e03c9fe2c80980b2916ef53bb995e7246467b57fbd37ae176185879744a0c1a7ec5d","ssdeep":"96:jJeT6TTVShwEsmEMNJexHJrmUnMKH8z3FzunS5jbr5JGIhnilIX+XPhl0rjLy:o6TBewEsmXexptnMJVunK5IU3X3y","tlshash":"651240cdf6c7f51a5167bab4907b001a733bbc2a204e0854f12bcdd62879659a13bf78","first_seen":"2025-04-24T21:35:04.954972Z","last_seen":"2026-08-12T20:06:40.301774Z","times_seen":17569,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/media/SourceSansPro-Regular.0d69e5ff5e92ac64a0c9.woff2","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:38.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/media/SourceSansPro-Regular.0d69e5ff5e92ac64a0c9.woff2 HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance.actions.atwork.ai/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 77664\r\nContent-Type: application/octet-stream\r\nDate: Fri, 27 Feb 2026 06:07:38 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nETag: \"ba90a26a7d134aeb2107b84a6220586f483b00434405c825d0bd31f6aa2e8a39754080a96d31a88e703b26f9f04c4aa93f7e949559742eaeca061c36c092e655\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":77664,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 77664, version 2.2949","md5":"5c0f519297ea97db4f2912905aeeb6cb","sha1":"2c0097552876b6541fcd73afa099d56c8a2ad355","sha256":"f95aeb72e6e2a20e900157d0bf8a8eae1415882bb9075bb668cd2d2276ed0ee6","sha512":"ba90a26a7d134aeb2107b84a6220586f483b00434405c825d0bd31f6aa2e8a39754080a96d31a88e703b26f9f04c4aa93f7e949559742eaeca061c36c092e655","ssdeep":"1536:KWmb5J5l4lWzgIQjWnosiQcUe/LQOz6zdE4QcI1ZnU7:KR9Dq8zgbWn/ihUYLzT/no","tlshash":"af73020c8a4a1745c9eae19b89bf165dc025f6318ad15bee66ef01bf3439e99c38031c","first_seen":"2023-07-01T05:39:41Z","last_seen":"2026-08-06T08:29:24.407373Z","times_seen":165,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":36,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/_stcore/health","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:39.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /_stcore/health HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nContent-Type: text/html; charset=UTF-8\r\nDate: Fri, 27 Feb 2026 06:07:39 GMT\r\nServer: TornadoServer/6.4\r\nCache-Control: no-cache\r\nETag: \"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb\"\r\nSet-Cookie: _xsrf=2|276ee166|e8ee0d13db1b5a981876767ce269bee6|1772172459; Path=/\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":2,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"ASCII text, with no line terminators","md5":"444bcb3a3fcf8389296c49467f27e1d6","sha1":"7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb","sha256":"2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df","sha512":"9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570","ssdeep":"","tlshash":"c710000000000000300000000000000000000000000000000000000000000c0000c000","first_seen":"2023-03-08T02:32:37Z","last_seen":"2026-08-12T22:51:34.899419Z","times_seen":448074,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/media/SourceSansPro-Bold.118dea98980e20a81ced.woff2","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:38.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/media/SourceSansPro-Bold.118dea98980e20a81ced.woff2 HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://postfinance.actions.atwork.ai/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 76860\r\nContent-Type: application/octet-stream\r\nDate: Fri, 27 Feb 2026 06:07:38 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nETag: \"0831aea0b3336915259bccb2017a6a5f9a2088d10c929cf791b221e5df122cdef37f8eadfea1d10357b5a4c11ba9811e5020a208716b7562fb34d9327fe33221\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":76860,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 76860, version 2.2949","md5":"19e9f35589c9abb072755df4ab19175c","sha1":"331456c717fc6cda9ebd0aa52f3f314a9e1ac513","sha256":"c31bb17f05447de37c3a8eee000c99d76c4a04a0e9756967d51b78e2040b9c48","sha512":"0831aea0b3336915259bccb2017a6a5f9a2088d10c929cf791b221e5df122cdef37f8eadfea1d10357b5a4c11ba9811e5020a208716b7562fb34d9327fe33221","ssdeep":"1536:rjigXF4xOYAvTHvfalqRbzVrZ80ghSGJaocpPDMhPuCNvPn78JjkZgOX2z:rjigV4xOR3AgbpF80cSGJvtECRIJCZXi","tlshash":"e9730207bf03f89ace64d97b85018293167a3f3e593a14d50abd8ec6b6a5f0d6023f14","first_seen":"2023-07-01T05:39:41Z","last_seen":"2026-07-21T02:01:41.951963Z","times_seen":103,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":45,"dns":0,"connect":18,"send":0,"wait":26,"receive":38,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/9/95/PostFinance_Logo.svg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.813Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Feb 2026 06:44:51 GMT","end":"Wed, 13 May 2026 06:44:50 GMT"},"fingerprint":{"sha1":"88:E4:43:3F:CC:87:1D:73:6E:F1:49:80:44:76:A9:8C:17:D8:DC:40","sha256":"59:E3:D6:A8:2D:49:87:A7:F3:1E:35:0E:3A:0F:77:A1:0B:7D:32:09:4C:1F:9F:2D:5D:0F:42:89:16:CB:BF:08"}}},"request":{"raw":"GET /wikipedia/commons/9/95/PostFinance_Logo.svg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/svg+xml\r\nx-object-meta-sha1base36: 9mkxupg3101mtlg3g8a5pxrdkdzivdm\r\nlast-modified: Sun, 06 Oct 2013 14:00:01 GMT\r\ndate: Thu, 26 Feb 2026 16:26:18 GMT\r\nserver: envoy\r\netag: W/469e8a9bcf948a92cb60852a23f4f7de\r\ncontent-encoding: gzip\r\nage: 49282\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nx-cache: cp3076 hit, cp3076 hit/7\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=lUp_gO2YvOJaEP9ntEdKHwMUAAAAAFvdVNVLmLQtb7fdXM0ZQ0qV4EIDcnCDVywU;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sat, 27 Feb 2027 00:00:00 GMT\r\ncontent-length: 2551\r\nx-request-id: 37e136ac-2834-4dad-a68f-373f944f2b45\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5992,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"469e8a9bcf948a92cb60852a23f4f7de","sha1":"526ad91bb49586222550e2546bf2f74bffee465a","sha256":"84f9b374085ef9935ca2a75037bd0dd02baeba4af2f791aef2cec387f21f0a0f","sha512":"1ce7eed0345995bc62935ba2b9417d1a6f1cc069f5f5c2bab85a919ac33729c2a0696ae3b288a292ede68d39c428ee6e012cc7de3f8760a4c39d273246899a4e","ssdeep":"96:/koIanERpiP9mpyFksevepJZMb8iC9H22rWOaGv62M4HzRqvaRx7ns:/kLg1mpyFyepJDVz6SCwWaRu","tlshash":"78c1b59dd3aa01f4d5cc4b48a7f834000a562ca73d251dcdf96d48e56f22f8e295cee2","first_seen":"2026-01-08T15:35:44.829894Z","last_seen":"2026-02-27T13:06:51.544497Z","times_seen":4,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":86,"dns":26,"connect":24,"send":0,"wait":25,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/9/95/PostFinance_Logo.svg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Feb 2026 06:44:51 GMT","end":"Wed, 13 May 2026 06:44:50 GMT"},"fingerprint":{"sha1":"88:E4:43:3F:CC:87:1D:73:6E:F1:49:80:44:76:A9:8C:17:D8:DC:40","sha256":"59:E3:D6:A8:2D:49:87:A7:F3:1E:35:0E:3A:0F:77:A1:0B:7D:32:09:4C:1F:9F:2D:5D:0F:42:89:16:CB:BF:08"}}},"request":{"raw":"GET /wikipedia/commons/9/95/PostFinance_Logo.svg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nCookie: WMF-Uniq=lUp_gO2YvOJaEP9ntEdKHwMUAAAAAFvdVNVLmLQtb7fdXM0ZQ0qV4EIDcnCDVywU\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/svg+xml\r\nx-object-meta-sha1base36: 9mkxupg3101mtlg3g8a5pxrdkdzivdm\r\nlast-modified: Sun, 06 Oct 2013 14:00:01 GMT\r\ndate: Thu, 26 Feb 2026 16:26:18 GMT\r\nserver: envoy\r\netag: W/469e8a9bcf948a92cb60852a23f4f7de\r\ncontent-encoding: gzip\r\nage: 49282\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nx-cache: cp3076 hit, cp3076 hit/8\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=lUp_gO2YvOJaEP9ntEdKHwMUAAEBAFvd3wmVlcuzlwVLTWgGsN8kPks2DzK36Stz;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sat, 27 Feb 2027 00:00:00 GMT\r\ncontent-length: 2551\r\nx-request-id: f1819432-f358-493e-8f10-665bdb3af3fe\r\nx-analytics: \r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5992,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"469e8a9bcf948a92cb60852a23f4f7de","sha1":"526ad91bb49586222550e2546bf2f74bffee465a","sha256":"84f9b374085ef9935ca2a75037bd0dd02baeba4af2f791aef2cec387f21f0a0f","sha512":"1ce7eed0345995bc62935ba2b9417d1a6f1cc069f5f5c2bab85a919ac33729c2a0696ae3b288a292ede68d39c428ee6e012cc7de3f8760a4c39d273246899a4e","ssdeep":"96:/koIanERpiP9mpyFksevepJZMb8iC9H22rWOaGv62M4HzRqvaRx7ns:/kLg1mpyFyepJDVz6SCwWaRu","tlshash":"78c1b59dd3aa01f4d5cc4b48a7f834000a562ca73d251dcdf96d48e56f22f8e295cee2","first_seen":"2026-01-08T15:35:44.829894Z","last_seen":"2026-02-27T13:06:51.544497Z","times_seen":4,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/favicon.png","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:39.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 1019\r\nContent-Type: image/png\r\nDate: Fri, 27 Feb 2026 06:07:39 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nETag: \"201430b41172e7b03dd19546897bfc42940c3b7f34c6d65bc1b540162623a6b1b47dffdbc3fba234a2b3707681dd49b8941a2c99e4f78d10584cd0f7b35f76f4\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":1019,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"20356bee5e4f7b010a2d19d765d94d6f","sha1":"6c07b61592dda935a760b4814d882928e82178d2","sha256":"89fe5c560c3b6b3c4a3af5791691a2c606bb24b9f6deb7e71dccb509d588d7e1","sha512":"201430b41172e7b03dd19546897bfc42940c3b7f34c6d65bc1b540162623a6b1b47dffdbc3fba234a2b3707681dd49b8941a2c99e4f78d10584cd0f7b35f76f4","ssdeep":"","tlshash":"42110ccd060d70f69d3d436b41d21d15793b1cd73c15202473a2a08b6e4203db88bf5e","first_seen":"2023-07-31T21:10:21Z","last_seen":"2026-08-10T12:18:20.354226Z","times_seen":132,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/analytics.js/v1/iCkMy7ymtJ9qYzQRXkQpnAJEq7D4NyMU/analytics.min.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.segment.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 16 Sep 2025 00:00:00 GMT","end":"Thu, 15 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"90:3F:7C:B8:04:2E:CD:A4:E1:F1:8C:5D:DB:17:18:85:E6:C0:E9:98","sha256":"18:9C:5C:43:17:4C:C1:EA:72:5A:8E:DD:37:64:4C:DF:83:99:F4:51:8E:85:20:61:7F:A0:40:01:DC:6F:65:43"}}},"request":{"raw":"GET /analytics.js/v1/iCkMy7ymtJ9qYzQRXkQpnAJEq7D4NyMU/analytics.min.js HTTP/1.1\r\nHost: cdn.segment.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/javascript; charset=utf-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-max-age: 3000\r\nx-amz-replication-status: COMPLETED\r\nlast-modified: Wed, 30 Apr 2025 17:28:28 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: 2jwtRVaKQvboHUfb978F1O3A8yKXZrr8\r\ncontent-encoding: br\r\ndate: Fri, 27 Feb 2026 06:07:25 GMT\r\ncache-control: public, max-age=120\r\netag: W/\"5bab93260bd369652f206725ab3aa1cf\"\r\nvary: accept-encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 b78539d5f13f3162976a6abc8783d3de.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: 9Wqwfc1c5EJPJ5uO_6SC62e8OMWrOK-aOpFnRSKeD15GAiPxcH3DHw==\r\nage: 25\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":108916,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"5bab93260bd369652f206725ab3aa1cf","sha1":"4b14d613589c68d2264c7316646c810688341040","sha256":"221d24137c91bde35da1a4475663174a99d785fc5d3b6683b13c5996d06a0c46","sha512":"86b4a3def6d543275a3d39550b68de96fa9ce20cc8c943e399862fcfaa100495d95924dbe422b210c9e7e11d663e0161fd14f06af397f8e43a04611f514bb951","ssdeep":"768:IAObYQP9MBThbyDRP0aubWc+ZdLyiQL96+hYs17eFCgt/oJBpntD/PN/xd0MpIJ4:TQP9MtMZ+vCBF/g0vmBuNfftrcuk","tlshash":"36b371c8f6d6f064439764b4803f510bf23eb96e680e8464f266dad26c7899d9133f78","first_seen":"2025-06-30T08:42:35.936454Z","last_seen":"2026-05-20T13:43:34.897115Z","times_seen":14,"resource_available":true,"data":null}},"time_used":126,"timings":{"blocked":58,"dns":35,"connect":8,"send":0,"wait":10,"receive":0,"ssl":12},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.1b218d13fed021531d4e.js","fqdn":"cdn.segment.com","domain":"segment.com","tld":"com"},"ip":{"addr":"3.164.239.145","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.312Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.segment.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M04","organization":"Amazon"},"validity":{"start":"Tue, 16 Sep 2025 00:00:00 GMT","end":"Thu, 15 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"90:3F:7C:B8:04:2E:CD:A4:E1:F1:8C:5D:DB:17:18:85:E6:C0:E9:98","sha256":"18:9C:5C:43:17:4C:C1:EA:72:5A:8E:DD:37:64:4C:DF:83:99:F4:51:8E:85:20:61:7F:A0:40:01:DC:6F:65:43"}}},"request":{"raw":"GET /analytics-next/bundles/schemaFilter.bundle.1b218d13fed021531d4e.js HTTP/1.1\r\nHost: cdn.segment.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript\r\ndate: Wed, 12 Mar 2025 15:21:49 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, HEAD\r\naccess-control-max-age: 3000\r\nx-amz-replication-status: COMPLETED\r\nlast-modified: Tue, 11 Mar 2025 23:36:37 GMT\r\nserver: AmazonS3\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=31536000,immutable\r\nx-amz-version-id: us8mp6fk6jRNGd8_iPNbBMEIU6.4k.B7\r\ncontent-encoding: br\r\netag: W/\"409caee2a9c8f0a6aba854d05642d2bc\"\r\nvary: accept-encoding\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 b78539d5f13f3162976a6abc8783d3de.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P2\r\nx-amz-cf-id: TTyM1cApb573UOTyxP7yllnHafN7vnO8fuhnQ5FrX58r2kEm7hfR7Q==\r\nage: 30379552\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":1559,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1490)","md5":"409caee2a9c8f0a6aba854d05642d2bc","sha1":"8a82603bb351a4356e612d8b2e8ba0d6c202c466","sha256":"740f4d03a4a3b214202a9cca049ba2cdfafe0573a7882f2c99cd009c436ab70d","sha512":"9682edf819a9237420550ca4867507c5ff1ac705c5a663787e7cb92f7f9b21fc4b4f5e295eb81982f65f97788c620ac2b6907f81a52a373eb6773362c214c83d","ssdeep":"","tlshash":"c0313fc979d1fa4415bb1cb2c4bfa01fb33dfc96106f8052f052cca0282928d9623d25","first_seen":"2025-04-24T21:35:05.034052Z","last_seen":"2026-08-12T20:06:40.259731Z","times_seen":17555,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-27T06:07:37.465Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nDate: Fri, 27 Feb 2026 06:07:37 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: no-cache\r\nContent-Encoding: gzip\r\nETag: \"640a88aa3cab5e0011cb98f23c15b1cf6991154798f312c77a0bb927a04dc0cd326539aaefcc5a8c69c48526d70192d026781db0b9f9b5bf0e1cda3506edea22\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nTransfer-Encoding: chunked\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":892,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (892), with no line terminators","md5":"b45531f9a06c6993ad7b0ce7c5f4d43e","sha1":"d2f9de58796c4953ef6057c99b10b0d9f7f8389c","sha256":"5a48d2d8b5111eee08fa0117083a499f945586ce12be927671bb338493c30785","sha512":"640a88aa3cab5e0011cb98f23c15b1cf6991154798f312c77a0bb927a04dc0cd326539aaefcc5a8c69c48526d70192d026781db0b9f9b5bf0e1cda3506edea22","ssdeep":"","tlshash":"001100a2fc0ac8cc2b706726fa69b028854a89191d68ac50dc9f197fcc927a24d29649","first_seen":"2026-02-27T00:42:31.785495Z","last_seen":"2026-02-27T13:06:51.53878Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1042,"timings":{"blocked":508,"dns":175,"connect":18,"send":0,"wait":26,"receive":0,"ssl":312},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/9656.8c935274.chunk.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.806Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/js/9656.8c935274.chunk.js HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nCookie: _xsrf=2|2f063928|36c7f758eda1e604b58111f7726d441f|1772172460; ajs_anonymous_id=93ae245c-1ae4-4efe-b4bc-2f5ed510debc\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/javascript\r\nDate: Fri, 27 Feb 2026 06:07:40 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nContent-Encoding: gzip\r\nETag: \"959d6481cac69cc24ea40bc9c264aa82e5350de22c85f6d99ac956c90709568b628aa36cf1dc44da0b8a442a26653ecf9cd8ac0728d505059ff2a0a9a23dd36d\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nTransfer-Encoding: chunked\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":22113,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (22113), with no line terminators","md5":"97306efdcb790815e8c030813fed8cc5","sha1":"c27a214d38657d877982a39b01e4c43d1fbcd8fe","sha256":"dd507a353d04404ac9517d9260b42998d029d7db16238e406cd3902d58dcbc82","sha512":"959d6481cac69cc24ea40bc9c264aa82e5350de22c85f6d99ac956c90709568b628aa36cf1dc44da0b8a442a26653ecf9cd8ac0728d505059ff2a0a9a23dd36d","ssdeep":"384:gnCTErCGlCflKr9DJ/T1rNKi6a3nFzprxTrzdNzAQAC:gnCgrCGlCfkprN/6QrzdaQ9","tlshash":"37a21ad472d1f05a3673e0bca0af4546f27b766db06c5a41b32698e02db215da331f3a","first_seen":"2024-04-10T21:15:18Z","last_seen":"2026-07-15T23:51:24.759245Z","times_seen":15,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"postfinance.actions.atwork.ai/static/js/8691.ee84f70b.chunk.js","fqdn":"postfinance.actions.atwork.ai","domain":"atwork.ai","tld":"ai"},"ip":{"addr":"20.105.232.15","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://postfinance.actions.atwork.ai/","date":"2026-02-27T06:07:40.808Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postfinance.actions.atwork.ai","organization":""},"issuer":{"commonName":"GeoTrust TLS RSA CA G1","organization":"DigiCert Inc"},"validity":{"start":"Thu, 26 Feb 2026 00:00:00 GMT","end":"Wed, 26 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"57:26:EC:15:C6:AC:3A:A2:54:75:02:2B:39:4F:49:B3:E1:4F:0B:05","sha256":"D2:06:0F:80:2E:FC:E8:28:2B:7F:B3:C4:FD:BF:96:7E:A6:11:F6:66:D5:1F:A6:0E:F8:57:19:75:A9:B2:E6:D5"}}},"request":{"raw":"GET /static/js/8691.ee84f70b.chunk.js HTTP/1.1\r\nHost: postfinance.actions.atwork.ai\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://postfinance.actions.atwork.ai/\r\nCookie: _xsrf=2|2f063928|36c7f758eda1e604b58111f7726d441f|1772172460; ajs_anonymous_id=93ae245c-1ae4-4efe-b4bc-2f5ed510debc\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Type: application/javascript\r\nDate: Fri, 27 Feb 2026 06:07:40 GMT\r\nServer: TornadoServer/6.4\r\nAccept-Ranges: bytes\r\nCache-Control: public\r\nContent-Encoding: gzip\r\nETag: \"b468a55a7ffd4da6e49a497a5161ad0ceb5f07b6b6c5ddb61b80aa5bf98fca85ab4fa42d81e6282ef6885711a0a9f65efaf3502f50040a2ba343373bc03ad442\"\r\nLast-Modified: Tue, 24 Feb 2026 10:21:10 GMT\r\nTransfer-Encoding: chunked\r\nVary: Accept-Encoding\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"TornadoServer:6.4","description":"","website":"https://tornadoweb.org","common_platform_enumeration":"","icon":"TornadoServer.png","categories":["Web servers"]}],"data":{"size":10248,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10248), with no line terminators","md5":"2331618a595829f2089acbb7e607f90e","sha1":"08e220562db3913d0c5f6bb926bfcb0b210cc841","sha256":"26424a60d94c4dd79766d236fd72f52fd0f211799533c5d2533754b1afc75dd6","sha512":"b468a55a7ffd4da6e49a497a5161ad0ceb5f07b6b6c5ddb61b80aa5bf98fca85ab4fa42d81e6282ef6885711a0a9f65efaf3502f50040a2ba343373bc03ad442","ssdeep":"192:AY96jTJ0fpudNn2NFY+aQKWHQQC5mD7CphqTO6S70W0BUY:AY96jT+eNnIrhKECvqTPb1BUY","tlshash":"4922d68472e2f07417ea849dc46f520af225ba1ee10dc0d0f63ad8e868f59cb5167f39","first_seen":"2026-02-27T00:42:31.784285Z","last_seen":"2026-05-03T14:18:01.585468Z","times_seen":4,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-02-27","alert":"Sinkholed","trigger":"postfinance.actions.atwork.ai","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-02-27","alert":"Phishing Block","trigger":"postfinance.actions.atwork.ai","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}