Report - aiitpune.com/js/gfyi/d2VuZHlfZGFlbGVtYW5zQHZmYy5jb20=

Report Overview

Submitted URL
aiitpune.com/js/gfyi/d2VuZHlfZGFlbGVtYW5zQHZmYy5jb20=
IP
132.148.128.8
ASN
#398101 GO-DADDY-COM-LLC
Submitted
2024-04-16 05:45:30
Access
public
Website Title
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Final URL
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Tags
phishing microsoft outlook
urlquery detections
Phishing - Microsoft Outlook

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2024-04-15	3.2 kB	169 kB	104.17.2.184
dc3889e1.b24b366159a504c34a2004dc.workers.dev	unknown	2019-02-08	2024-04-11	2024-04-15	1.3 kB	32 kB	104.21.94.180
mailfoneuscellular.com	unknown	2024-01-23	2024-04-11	2024-04-12	2.1 kB	9.6 kB	51.161.109.46
aiitpune.com	unknown	2013-02-06	2017-08-24	2024-04-15	507 B	293 B	132.148.128.8

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (37)

		Size	First Seen	Last Seen
	#1 Eval - 323fed395d3e1684f488fd7a014a7651	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 323fed395d3e1684f488fd7a014a7651 5f9c54e0e4643fcf5581108da2587518de6ffa4c fbd8b25e962aa068632ae87155b28718807107c4493d93b6ce568c3c1c0e6fbc Loading...

	#2 Eval - 0de280ac309c39f54528759e31b538bd	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 0de280ac309c39f54528759e31b538bd 63b1608c0540b5deb14f063687a21cb2352abfcd 6e5a2257edee5e3b51046eff7b078c4226c2db8edad740063cc74e2ad419f8e6 Loading...

	#3 Eval - 30edf7c4b038f270c96c633fb384ffe3	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 30edf7c4b038f270c96c633fb384ffe3 319b7ca95ee4452e58ce5ca606f733f083435772 43ac240104f80ee77aae38e235250a49bf179d6b2bb328d66a10146224cd940f Loading...

	#4 Eval - 9f1a9b4262e9a1c0d501b4220ff4c66f	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 9f1a9b4262e9a1c0d501b4220ff4c66f 420a2a0ad1dade6975ba24a52393b69651481e37 37c00e310569614593802fc5cfca703f9ec0050f9abfcf3edfdc1c52257b2da6 Loading...

	#5 Eval - 5dcd82922dc0b27e772714e228d4a50b	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 5dcd82922dc0b27e772714e228d4a50b 0a7897fcc9ef90475313d58f313fc69aa8f724c6 1240d3e8cc6da4fe6979051a75ae9620e1ecb2a244fbed615ab6b2f07398616e Loading...

	#6 Eval - 1ac3ce92fbc76be53845bd8d0b4aa105	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:30 Times Seen1 Hash 1ac3ce92fbc76be53845bd8d0b4aa105 65decccee686f0d22eaed14b670491d5f3ec8c0e 259d974e56f605df894b4b922e1e05389970436b88c1723fe7764a5653a24661 Loading...

	#7 Eval - f1c35bd861bd2e17521f4619b9404cad	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:30 Last Seen2024-04-16 07:45:31 Times Seen1 Hash f1c35bd861bd2e17521f4619b9404cad 5fba4aa2613d2ccba0ac511827757f92ceea440e 3b4cf13f6b93dfe94c2e77fd88b01022f5aa374e5746f1031c04c4e8d4114366 Loading...

	#8 Eval - 8087f91986a50293745747e53a515ac3	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 8087f91986a50293745747e53a515ac3 736ebc95b01f258139d76f00c2cbd3091d26e2f0 da1f3b75b9a7c192a314de97ee25d4ef36120a92db9437a1848ba5e6033e1a3a Loading...

	#9 Eval - 77674c4b174f4ee0b38a870b86bdeff4	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 77674c4b174f4ee0b38a870b86bdeff4 58922f38278420640e66e02cd4e3db5353a44fbf 441c46b2cf80ecaa9165b3b226d057118e8eee130738165e22627f6a57e8c777 Loading...

	#10 Eval - 659fcba3d246dee580edb319313008cd	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 659fcba3d246dee580edb319313008cd 3cac9c39e418e6fd4aa01cab2451876641c8f3b2 e4c6361713bcf49a66f8d82673bb612ebf2a3cd2fb7d5e1eed83110aae4892e6 Loading...

	#11 Eval - 12bbcbd1184d8d619de4831c55c2f9d9	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 12bbcbd1184d8d619de4831c55c2f9d9 364477a503d2b00f5108f5c3cd5b0b6aa994083b 9ef8636283b5af14a6f26b5e983693cfeea781118d384fb02bec15e40b382b7f Loading...

	#12 Eval - 3b0c971e76b4abe5c054ca26f8fd797d	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 3b0c971e76b4abe5c054ca26f8fd797d 9f2a17dbc1015518e8cfd44ae6d7e87517dcd9f9 248aa1dce80e5cead4e98972c34824d9d3e799226d6ce1f5bb2292493f30dd5a Loading...

	#13 Eval - 7e7e7c7fc3c9d2a47dcd800182624a55	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 7e7e7c7fc3c9d2a47dcd800182624a55 fde4ba5f9d1b533f7ae36f93240756820b5992a6 ef45a7567904ceddf6f7fb8b54881d7303d33d2b21daaab15d317ed7c781fabc Loading...

	#14 Eval - 7069895e40316b2f0d8f7974250f64b7	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 7069895e40316b2f0d8f7974250f64b7 6794919943ce7d13ca0b6db008d3ed9eb2859519 77c2e29a1a987c84a64842943e9bdf52a69ec33d88dadd9efbce54a055fa0254 Loading...

	#15 Eval - 533e433939a84518ff68ed81f927b9b8	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 533e433939a84518ff68ed81f927b9b8 6e4cde31946dbed2888cb76066ed248794f20afa 73dd6e0662d85e194d8925329fc04c1ed97e74b2445987b4d9f6bd46ab6d8abe Loading...

	#16 Eval - d4692494a8c9717fd53fa55279f415de	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash d4692494a8c9717fd53fa55279f415de 10e82f5c974bd1c33e1f1898e3b0feb93875ad2c ec1ab38c090117392c977a344ceeddf758845b9aea77f552351f0bb757e56c15 Loading...

	#17 Eval - 4e60781134e79eae93213c5adb2ce560	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 4e60781134e79eae93213c5adb2ce560 49adf3ac6455ae723192afabc6351a2978e0fc10 525dcc6fb3a0538f021a364d297ae9971392ca06a73ca4e0ec393e4dc33c3436 Loading...

	#18 Eval - bb61276967fa2cec3b5706d22d1c2c83	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash bb61276967fa2cec3b5706d22d1c2c83 f01ac6478ce134a41c8aa624f208c82cd07a2be8 d5811fb824c95f315528e5d7357d988b237d7ce03db8e4af120a7f5fca170ffd Loading...

	#19 Eval - e9644647a24798c284dff9bc33215629	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash e9644647a24798c284dff9bc33215629 2d52c3d64d66757d701d3786ebf8637134d33ac1 3a8c74428fbcaefc35df42f1cd329269abf930a892860c8be2e50e15c876378b Loading...

	#20 Eval - f3cf82ce9a43b90eed9ed12cb3f2c76c	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash f3cf82ce9a43b90eed9ed12cb3f2c76c c699fb9d14c6258224a36c19fbe42802db0b8caa ba916da84c39bea128e68bdc4ae5d3470c420a8f62fd034ffeec239946b1bb1c Loading...

	#21 Eval - 5043b2be810213d021d5c4cc3e487c1a	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 5043b2be810213d021d5c4cc3e487c1a 17be33d2250bc0d0b4cac75217f886a2ac9f7618 0b95ac50c6b310bdbce882f97e996992b936ab46910bf0c815a1e337d230edb3 Loading...

	#22 Eval - fb9af47636e29b0d44f758dc6278a935	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash fb9af47636e29b0d44f758dc6278a935 2111f076d42b708b0a3322b61e3c71fab80e5a6b 8a09f0503b86149ef30578028bd5f8b7478c7e74dbd1abcf0ff0fb82b9e63687 Loading...

	#23 Eval - c1feeae8d88d7600ee9c5d848d2c8ef8	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash c1feeae8d88d7600ee9c5d848d2c8ef8 61e48e8734e200404ea2727476b29ae22dcc91aa 5aee38ef3265fbdae7e9164550619f86bc7cb780d6ff42589003034239b2e303 Loading...

	#24 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07	2024-04-29
Pretty Observations First Seen2023-03-07 01:03:43 Last Seen2024-04-29 18:54:15 Times Seen350559 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#25 Eval - 8c1c1d5b57dbc6cc87082798be91743f	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 8c1c1d5b57dbc6cc87082798be91743f 5900f6191993a28da50ff5e4da3cc8241e02d4a7 bb8866e4272ceb47bff14ac1abf27dbef9fca112dc5cd01629da69c3617da043 Loading...

	#26 Eval - a0a6ca515d677066f4de7f0e6d3c070f	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash a0a6ca515d677066f4de7f0e6d3c070f 90401ec275aec9ac3afd77e48cced7706258f5bc 552b31da2c827786c0850fb3cc96d6016a3a625d5f0578797f353a3c38aa35f8 Loading...

	#27 Eval - 1fb7b6654fa76884d272618f72bb2d89	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 1fb7b6654fa76884d272618f72bb2d89 c4340d8c145cc30886c7f61ef9a815d7dda695ef baa132e81ebb86b42af229f9dd7f20f1b80f0de852e582498c7d187394d40726 Loading...

	#28 Eval - c23ca036fed4b1348db3029ab1dab610	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash c23ca036fed4b1348db3029ab1dab610 0ab19c8c9c6800e6456189e6b5f0ac1bfd574bca 394d7a24c5b3e1b501a44e841a3aae5fed0edbd1f56526efef5c32a5c846e7f0 Loading...

	#29 Eval - 420010fb85b0bcbbebeb2bd1997a3c48	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 420010fb85b0bcbbebeb2bd1997a3c48 d451ce5d0241a9513d76414980386f6e229de6ba 23670cb8832a65e469eae2cf9d4117af055a1caa14bdd9f87ffecec8f4447897 Loading...

	#30 Eval - c152cae0f74552e67c3d3127058b3dc6	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash c152cae0f74552e67c3d3127058b3dc6 b6157a270ee23b53fe72b323450a0a24f321fb0f 5088adb042782ac8218e09465be6a0ac479194117a3d3de909e0185ad9c90cbe Loading...

	#31 Eval - 81d1c0fd3466806d9950ba58d241c900	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 81d1c0fd3466806d9950ba58d241c900 3058b8755db8b96c986e00edb4f257b2373a4367 0c93f7a8dcddb9ec8417303553efb2aadea1dfe2b1f7d263c52cb7b7ef47072e Loading...

	#32 Eval - be48044550bb0209ef231610255b67b2	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash be48044550bb0209ef231610255b67b2 6c1d226e177877e0f2de2c13157948983eef8dfa 1e22b7cb5e70da916828c8b2969baaa5d29bcd0f52a763af9a6397de3abd8e20 Loading...

	#33 Eval - d20a6985207da90bbe48ffa7e2a326ae	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash d20a6985207da90bbe48ffa7e2a326ae 73d96f0465d7362ce9dc811f2f93b92fde5a3cf1 2398e4fafba96531104c59a6a08043af645dbbab7719f9629b149a759b500ed0 Loading...

	#34 Eval - ac6d43b49aec2f87daf340337b6a7882	60 B	2024-04-04	2024-04-17
Pretty Observations First Seen2024-04-04 12:28:09 Last Seen2024-04-17 16:04:31 Times Seen3428 Hash ac6d43b49aec2f87daf340337b6a7882 d3874a31a6b7fe11121edc3ed80fdc8b66f6589a 1af55b64e0b39e0f5f760a8050b284a66fe404ddff945697590f8240798311b2 Loading...

	#35 Eval - c33b570eb23d191301c5db2f4027457a	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash c33b570eb23d191301c5db2f4027457a 2c12a4722b2bcb521f96d48a58920e67118e8131 6856a3148b1a5886cdd14ccf521eb04c1fcb39cc5b4edd3d3fb7773694f30649 Loading...

	#36 Eval - 470729e8e8f97b79c4c07b29d8ab6e8f	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 470729e8e8f97b79c4c07b29d8ab6e8f 05fcd93ecb1730934891a4c50692490902225907 02239dfa8f54b60c47b38cd4ada319360b62c4270ed450fbcfbf797c623eb06e Loading...

	#37 Eval - 51dd9fdc6fa029277012f71c80f277e1	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 07:45:31 Last Seen2024-04-16 07:45:31 Times Seen1 Hash 51dd9fdc6fa029277012f71c80f277e1 ea3c37945b3b5c7d852235412d27c3f928a78da7 56879e2f29860b273b0df62dcb2267ea8cc32b280c69285ccab1fff6b705240b Loading...

HTTP Transactions (11)

URL IP Response Size

aiitpune.com/js/gfyi/d2VuZHlfZGFlbGVtYW5zQHZmYy5jb20=

132.148.128.8

0 B

URL
aiitpune.com/js/gfyi/d2VuZHlfZGFlbGVtYW5zQHZmYy5jb20=
IP
132.148.128.8:0
ASN
#398101 GO-DADDY-COM-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /js/gfyi/d2VuZHlfZGFlbGVtYW5zQHZmYy5jb20= HTTP/1.1
Host: aiitpune.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 16 Apr 2024 05:45:05 GMT
Server: Apache
refresh: 0;url=https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.17.2.184

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 16 Apr 2024 05:45:05 GMT
content-length: 0
location: /turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: max-age=300, public
vary: Accept-Encoding
server: cloudflare
cf-ray: 8751de043a8856c6-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback

104.17.2.184

14 kB

URL
challenges.cloudflare.com/turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (40613)
Size
14 kB (14270 bytes)
Hash
d1048a66fc11ea28c3cb1488fac82c62
f055707cf91f637ec19bf5e65bf378857e798469
8f1ad19042c2f9ee60c2de21f37f788af7b1ecccda8eec1d877f9b9c0e994370

HTTP Headers

GET /turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 05:45:05 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8751de045aa056c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dc3889e1.b24b366159a504c34a2004dc.workers.dev/favicon.ico

104.21.94.180

200 OK

30 kB

URL GET HTTP/3
dc3889e1.b24b366159a504c34a2004dc.workers.dev/favicon.ico
IP
104.21.94.180:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Certificate
IssuerGoogle Trust Services LLC
Subjectb24b366159a504c34a2004dc.workers.dev
FingerprintBC:41:71:93:F8:C2:C5:7E:66:EE:C8:3A:E4:16:06:3D:23:73:EE:5F
ValidityThu, 11 Apr 2024 15:41:38 GMT - Wed, 10 Jul 2024 15:41:37 GMT

File type
HTML document, ASCII text, with very long lines (3255), with no line terminators
Size
30 kB (30147 bytes)
Hash
11482519dc727778115f3fcbfb28d1c7
633fb6ec307a6964e5c8a9b322bdcbcca243e30a
c9b17fb76673bd8a3ed7134667afe1324e9d3eb9a1561d021d10d3696db4b0e4

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: dc3889e1.b24b366159a504c34a2004dc.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 05:45:06 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PCIIxA9T7PXHIgICTUN9lbY9%2FoAzQV0Sn6uUKtrZdoYXjPIJLooohpvNQB41aJ8Gf3Ijigea%2Ft0RjzdTKBSRgA2OO7R%2Ba5qZzSMaMEOrPKULGBBTNhoCvjdMdeTaXWyJq1HsIG8jmcY9S3VKPsBBG3jmyMVMQ6caAPBl3vfmoX4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8751de04cf3e569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8751de04eb0056c6

104.17.2.184

126 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8751de04eb0056c6
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
126 kB (126097 bytes)
Hash
341a5aba4d0633f30c1bdf2042513b8e
46ec96946c4d8fcdadf63bf007c0c92c4a746851
7e5ffc8ff298dcfb48f414b11085890d625294ec1ac76fd177f777eeff99ebe3

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8751de04eb0056c6 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zm05y/0x4AAAAAAAW6FMm8tl7BXPFe/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 05:45:06 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server: cloudflare
cf-ray: 8751de054b4e56c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/498235490:1713241819:7DmdES8jpr-y9RxL5hFCH7lKr4yxnFe88q2NJSSJBrM/8751de04eb0056c6/97453c59360b4e4

104.17.2.184

23 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/498235490:1713241819:7DmdES8jpr-y9RxL5hFCH7lKr4yxnFe88q2NJSSJBrM/8751de04eb0056c6/97453c59360b4e4
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (22556), with no line terminators
Size
23 kB (22876 bytes)
Hash
250aee62f6700cd1f8557fa55240d4b6
7e5d383bdc4e4ebb53239bfbb2287132036c09f4
a6cb13e4764943273793c674c2018962da60dbe36af22cac548900605e5e5fcc

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/498235490:1713241819:7DmdES8jpr-y9RxL5hFCH7lKr4yxnFe88q2NJSSJBrM/8751de04eb0056c6/97453c59360b4e4 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zm05y/0x4AAAAAAAW6FMm8tl7BXPFe/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 97453c59360b4e4
Content-Length: 25336
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 05:45:07 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: 3+nuHVaP0kmZyCqAA5hvV372ty4MEuCIrKbTP5KDOmk6UqVu3ag8H2uNSQFGHKaH$j4iqjJV9MekSAOTOlB9Yqg==
server: cloudflare
cf-ray: 8751de0e5ab856c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1477153431:1713241908:ig3dEUMwkk-_bh-Kx3XIS8-15FNkJVirFCER-kUZjt8/8751de65efde56c6/43606cd3ff5d8a8

104.17.2.184

3.3 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1477153431:1713241908:ig3dEUMwkk-_bh-Kx3XIS8-15FNkJVirFCER-kUZjt8/8751de65efde56c6/43606cd3ff5d8a8
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (3496), with no line terminators
Size
3.3 kB (3260 bytes)
Hash
f3a023fa233f0494fa1069b584331ff5
7c2a16d93abd27de9f08c83d241cc12e87db7839
dfea667582cd4e5e92e133b470b7575bd8c55a3b6829e37bb7d50c203ada60a9

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1477153431:1713241908:ig3dEUMwkk-_bh-Kx3XIS8-15FNkJVirFCER-kUZjt8/8751de65efde56c6/43606cd3ff5d8a8 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv1/toL804vmeDYrjlL/zm05y/0x4AAAAAAAW6FMm8tl7BXPFe/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 43606cd3ff5d8a8
Content-Length: 34995
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 05:45:25 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: xAhuncE1sY8jaAp5d9hIMo/3kXQ2OyMCfFWq7H3j0XMkMOnvjQ3JY8SY7OWHV9DZv9mPxbF3XDEAXb0FQHZoise/o1qCfyGx2Y9ys5kXPjM63bNZj3XibXRK0ENMFd0U$5paM3ZbpH0BNvtU1QI7TBQ==
cf-chl-out-s: lcPY5vykrUKMsYxMFMe8AXXCs0jENq0MUO2pmVlPG0nzDYuYUmsZ3li6AdvP1oD0rNKVvAPsFjkyTU9UaOJI0OTJDUfFKjHDqhCsBhRX2U1eT7s6r9TZxf7oBE+dTTm8QOWpwrC0fjyXQ9w1dYzv75nwNs0ekLK/wSWcq2pGP9ZwTPKG+dRNYm6LKFQu/Vs01ACRlchnuhv2WHuEbhA0dM3C70ueuy9Rn3lTjn7AjnBMzRwEaKd49b18zXKUMMTdd3S44tlAyPpkCRKHmCgf4uQGm+Rn0SxoZ/PA3Q6GUWdg1gq1QKq4RAns/tVtPFE4EVNFOdEXGO2PYUYhXrnk7911Z3w6hMoeKzl1DnG02LC8nORfhAV3pviV4uWns0muGSelgkMM+cd2hbNiMbMXGEmIaaZ+IWV4C0zHCEW+m+TCCEg1GGOlIVsKZEYIpuVjXO1zKY8RmxkzrjUpwKLop5kLXIosj469ybk6j0X7Ota9G1qyg54J94Dhh39ckWa4WIc0FSIyypxwpCizLgCUb4P8GpMSjHrMFS6mpZIocYvRA3tgg/U3f2gZ3m9c/IqKazM6La2rUDt/oG+1WgGeH31RxFrCYhH3kFIrSYCBOvDkNJ9XMIBUwrwJI6T39Fmj$m3BY8MF43tbhruRrlA1qyg==
server: cloudflare
cf-ray: 8751de804c1f56c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

mailfoneuscellular.com/?qrc=wendy_daelemans%40vfc.com

51.161.109.46

0 B

URL GET
mailfoneuscellular.com/?qrc=wendy_daelemans%40vfc.com
IP
51.161.109.46:0
ASN
#16276 OVH SAS

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?qrc=wendy_daelemans%40vfc.com HTTP/1.1
Host: mailfoneuscellular.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=xo9vhklKDr54; qPdM.sig=VXns_UOJeEot5InB0j69mRixSpQ
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://mailfoneuscellular.com/owa/?login_hint=wendy_daelemans%40vfc.com
Server: Microsoft-IIS/10.0
request-id: 3e8dd4fe-d8d1-59bf-527e-e98fd8c23d05
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: YQBPR0101CA0231, YQBPR0101CA0231
X-RequestId: 7c7c630b-159c-4fb0-95fa-087c6008978f
X-FEProxyInfo: YQBPR0101CA0231.CANPRD01.PROD.OUTLOOK.COM
X-FEEFZInfo: YQB
MS-CV: /tSNPtHYv1lSfumP2MI9BQ.0
X-Powered-By: ASP.NET
Date: Tue, 16 Apr 2024 05:45:27 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

mailfoneuscellular.com/owa/?login_hint=wendy_daelemans%40vfc.com

51.161.109.46

1.4 kB

URL GET
mailfoneuscellular.com/owa/?login_hint=wendy_daelemans%40vfc.com
IP
51.161.109.46:0
ASN
#16276 OVH SAS

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com

File type
HTML document, ASCII text, with very long lines (805), with CRLF, LF line terminators
Size
1.4 kB (1385 bytes)
Hash
1712524ed6f68886d9d05275c026e988
0daf30472e1cdf8997f7838fb410e59ddcd57a41
d140bd7abff21ab6635d2647040e0d68d042405440b0285516f7f4bc98dacca5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /owa/?login_hint=wendy_daelemans%40vfc.com HTTP/1.1
Host: mailfoneuscellular.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=xo9vhklKDr54; qPdM.sig=VXns_UOJeEot5InB0j69mRixSpQ
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
content-length: 1385
Content-Type: text/html; charset=utf-8
Location: https://mailfoneuscellular.com/?2e3q8az7x=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD13ZW5keV9kYWVsZW1hbnMlNDB2ZmMuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTJlMzY5NjQyLTA2ZjgtYmM0ZC1hNGVjLTYwMjA3YzZmZTMwMCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg0ODg0MzEyODE3Nzc2NTQuOTk2YWYxNGYtNDI5Zi00OTJhLTllZjctOTRiOTY5ZDUzZTlhJnN0YXRlPURjdEJEc0lnRUVCUjBMTzRNYUV0TUFWbTBYaVVaaXlETm1saG9iSHg5cDNGZjd1dmxWSlg2U0xwUVZBeC1BUXBnYmN1MlJoakdLRkRERlFzRkFNT0JYUmtrRXMwQ0U4TW1FZlBTRnJlZTk4TzZoOWJlNjExZnFfMU94MWM4M19PeEJ2dlZEODNHSDVsNlphMm53
Server: Microsoft-IIS/10.0
request-id: 2e369642-06f8-bc4d-a4ec-60207c6fe300
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedBETarget: QB1PR01MB4020.CANPRD01.PROD.OUTLOOK.COM
X-BackEndHttpStatus: 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=CB8C36EBF77C4F7EA761BF3D5FC7D182; expires=Wed, 16-Apr-2025 05:45:28 GMT; path=/;SameSite=None; secure
ClientId=CB8C36EBF77C4F7EA761BF3D5FC7D182; expires=Wed, 16-Apr-2025 05:45:28 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Wed, 16-Oct-2024 05:45:28 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.nonce.v3.UGu-D9TsKFulu6kfj6V0gV-f12FMs74VSYsCAUphse0=638488431281777654.996af14f-429f-492a-9ef7-94b969d53e9a; expires=Tue, 16-Apr-2024 06:45:28 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OptInPrg=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
ClientId=CB8C36EBF77C4F7EA761BF3D5FC7D182; expires=Wed, 16-Apr-2025 05:45:28 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Wed, 16-Oct-2024 05:45:28 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=mailfoneuscellular.com; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OpenIdConnect.nonce.v3.UGu-D9TsKFulu6kfj6V0gV-f12FMs74VSYsCAUphse0=638488431281777654.996af14f-429f-492a-9ef7-94b969d53e9a; expires=Tue, 16-Apr-2024 06:45:28 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
OptInPrg=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 16-Apr-1994 05:45:28 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14B9iu_a9hd3Ag; expires=Tue, 16-Apr-2024 11:47:28 GMT; path=/;SameSite=None; secure; HttpOnly
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS5
X-OWA-DiagnosticsInfo: 1;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-04-16T05:45:28.177
X-BackEnd-End: 2024-04-16T05:45:28.177
X-DiagInfo: QB1PR01MB4020
X-BEServer: QB1PR01MB4020
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-Proxy-BackendServerStatus: 302
X-FirstHopCafeEFZ: YQB
X-FEProxyInfo: YQZPR01CA0160.CANPRD01.PROD.OUTLOOK.COM
X-FEEFZInfo: YQB
X-FEServer: YQZPR01CA0160
Date: Tue, 16 Apr 2024 05:45:28 GMT
Connection: close
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

mailfoneuscellular.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWxmb25ldXNjZWxsdWxhci5jb20iLCJkb21haW4iOiJtYWlsZm9uZXVzY2VsbHVsYXIuY29tIiwia2V5IjoieG85dmhrbEtEcjU0IiwicXJjIjoid2VuZHlfZGFlbGVtYW5zQHZmYy5jb20iLCJpYXQiOjE3MTMyNDYzMjYsImV4cCI6MTcxMzI0NjQ0Nn0._Iv_9JmyYqT218FrB4JxPf5ZfU4FFM7rH2lMCIDivec

0.0.0.0

0 B

URL GET
mailfoneuscellular.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWxmb25ldXNjZWxsdWxhci5jb20iLCJkb21haW4iOiJtYWlsZm9uZXVzY2VsbHVsYXIuY29tIiwia2V5IjoieG85dmhrbEtEcjU0IiwicXJjIjoid2VuZHlfZGFlbGVtYW5zQHZmYy5jb20iLCJpYXQiOjE3MTMyNDYzMjYsImV4cCI6MTcxMzI0NjQ0Nn0._Iv_9JmyYqT218FrB4JxPf5ZfU4FFM7rH2lMCIDivec
IP
0.0.0.0:0
ASN
#0

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWxmb25ldXNjZWxsdWxhci5jb20iLCJkb21haW4iOiJtYWlsZm9uZXVzY2VsbHVsYXIuY29tIiwia2V5IjoieG85dmhrbEtEcjU0IiwicXJjIjoid2VuZHlfZGFlbGVtYW5zQHZmYy5jb20iLCJpYXQiOjE3MTMyNDYzMjYsImV4cCI6MTcxMzI0NjQ0Nn0._Iv_9JmyYqT218FrB4JxPf5ZfU4FFM7rH2lMCIDivec HTTP/1.1
Host: mailfoneuscellular.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Set-Cookie: qPdM=xo9vhklKDr54; path=/; samesite=none; secure; httponly
qPdM.sig=VXns_UOJeEot5InB0j69mRixSpQ; path=/; samesite=none; secure; httponly
location: /?qrc=wendy_daelemans%40vfc.com
Date: Tue, 16 Apr 2024 05:45:27 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com

104.21.94.180

200 OK

1.2 kB

URL User Request POST HTTP/3
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
IP
104.21.94.180:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectb24b366159a504c34a2004dc.workers.dev
FingerprintBC:41:71:93:F8:C2:C5:7E:66:EE:C8:3A:E4:16:06:3D:23:73:EE:5F
ValidityThu, 11 Apr 2024 15:41:38 GMT - Wed, 10 Jul 2024 15:41:37 GMT

File type
HTML document, ASCII text, with very long lines (1208), with no line terminators
Size
1.2 kB (1188 bytes)
Hash
f79c7d945605777a898f9515936b8f76
57b3327232cff8b710fb29fd32d340d865b6ab9d
e7b699ec746a3eecde974019aee6aafb8f7f9d6d758ba4b698cf8b259f09fe21

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

POST /?qrc=wendy_daelemans@vfc.com HTTP/1.1
Host: dc3889e1.b24b366159a504c34a2004dc.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 582
Origin: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=wendy_daelemans@vfc.com
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 05:45:26 GMT
content-type: text/html;
status: 200
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SHv9zbqz%2FpK0hu6%2F7ZE57xqutRx69KauScPaoQkTnEnwCN3F5nZ3EM%2BO5PyWssonsahTOKu2dMIm%2FuELlCB%2F%2BsFalcdciX06Fqsp4Sl3nliSBTOiOf3gtnEIAJyoPhAIuEwEDaA8Gd4fj3ibmFxoJQXMAMErCaCuxxwwmpAT%2F6U%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8751de80a9b8569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (37)

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash