URL User Request GET HTTP/1.1IP 104.198.120.134:80
ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeHTML document, ASCII text, with very long lines (7903) Hash501ef065d334548baea1c88b8a797c52 a555beee5f4a4c62513faaa4d611e7ce9de41ba3 da539875dd0b49a5aaed4360377e208a1ad3886ead08e9aef7764f8125989782
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft | | OpenPhish | phishing | Outlook | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 104.198.120.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 05:54:52 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Wed, 30 Aug 2017 11:17:47 GMT
ETag: "d696-557f6ad7c9de4"
Accept-Ranges: bytes
Content-Length: 54934
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
| 104.198.120.134/owa/auth/15.0.1293/themes/resources/segoeui-regular.ttf | 104.198.120.134 | 404 Not Found | 253 B |
URL GET HTTP/1.1104.198.120.134/owa/auth/15.0.1293/themes/resources/segoeui-regular.ttf IP104.198.120.134:80 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeHTML document, ASCII text Hashee720d70e6bf1d55fbef4982000f04ce 266087c85ac5faafd68b437e372daf0513f58439 68b2ecb51eb0d65308e4af0812b0e305cc57b750633bbd4d00e178ab226f15ef
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft | | OpenPhish | phishing | Outlook | | Quad9 DNS | malicious | Sinkholed |
GET /owa/auth/15.0.1293/themes/resources/segoeui-regular.ttf HTTP/1.1
Host: 104.198.120.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://104.198.120.134/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 05:54:53 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 253
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| 104.198.120.134/owa/auth/15.0.1293/themes/resources/segoeui-semilight.ttf | 104.198.120.134 | 404 Not Found | 255 B |
URL GET HTTP/1.1104.198.120.134/owa/auth/15.0.1293/themes/resources/segoeui-semilight.ttf IP104.198.120.134:80 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeHTML document, ASCII text Hash5c708c8f334f249ef4fad8fb56435000 72efb05cbbe366a88659d549b702f8b00fe7e9c9 e1f4086c0803a55407013c39379c45a645a341de526b70cbd8d8cb2f671d473e
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft | | OpenPhish | phishing | Outlook | | Quad9 DNS | malicious | Sinkholed |
GET /owa/auth/15.0.1293/themes/resources/segoeui-semilight.ttf HTTP/1.1
Host: 104.198.120.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://104.198.120.134/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 05:54:53 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 255
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| 104.198.120.134/owa/auth/15.0.1293/themes/resources/favicon.ico | 104.198.120.134 | 404 Not Found | 245 B |
URL GET HTTP/1.1104.198.120.134/owa/auth/15.0.1293/themes/resources/favicon.ico IP104.198.120.134:80 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeHTML document, ASCII text Hash230e61bf0135ccb0100845bb2bf4930b cd906a556b2100a993e9947893d5d001fce62750 3260c9667bf6547bc4fd8cae7ed64f7d91b29780e9b1bff031423694c6782a50
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft | | OpenPhish | phishing | Outlook | | Quad9 DNS | malicious | Sinkholed |
GET /owa/auth/15.0.1293/themes/resources/favicon.ico HTTP/1.1
Host: 104.198.120.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://104.198.120.134/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 05:54:53 GMT
Server: Apache/2.4.6 (CentOS)
Content-Length: 245
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|