Report - rsirdc.net/xc

Report Overview

Submitted URL
rsirdc.net/xc
IP
91.234.195.123
ASN
#210403 Groupe LWS SARL
Submitted
2024-04-16 17:45:59
Access
public
Website Title
Outlook
Final URL
rsirdc.net/xc/
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
rsirdc.net	unknown	2024-02-02	2024-02-02	2024-04-16	2.6 kB	66 kB	91.234.195.123

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	rsirdc.net/xc	Outlook

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	rsirdc.net/xc/	17 kB	2024-04-16	2024-04-16
Pretty URL rsirdc.net/xc/ IP 91.234.195.123 ASN #210403 Groupe LWS SARL Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-16 19:46:01 Last Seen2024-04-16 19:46:01 Times Seen1 Hash 15d5124d019d6239a2628f58f8fb405b 0dabb9a0c0c7b9c1923f7e084ea3e9881fde5529 1102d89eb4be0645525e543398effdf73084211e97e4c09102ba1a6838c4871b Loading...

	rsirdc.net/xc/	1.3 kB	2024-04-16	2024-04-16
Pretty URL rsirdc.net/xc/ IP 91.234.195.123 ASN #210403 Groupe LWS SARL Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-16 19:46:01 Last Seen2024-04-16 19:46:01 Times Seen1 Hash f0362ae110fa28cc49e768a14d0f4fd4 377c84a283f1be1bbdc6d2669723537ac02e4577 5b675b6187df8691b64d19b122eab5c595e4b186fa82b78b4e5267e7074963a2 Loading...

	rsirdc.net/xc/	1.9 kB	2024-03-22	2024-04-16
Pretty URL rsirdc.net/xc/ IP 91.234.195.123 ASN #210403 Groupe LWS SARL Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-22 05:06:21 Last Seen2024-04-16 19:46:01 Times Seen2 Hash edbc013b1464a44759b85c8f418cf775 922976a0933556ea26edf336fc2f1b1263afda98 80fd2771b7b719ad8b5344de74c6f2265ed868fd8368ed7da14342557b5fc937 Loading...

	rsirdc.net/xc/	153 B	2023-03-07	2024-04-16
Pretty URL rsirdc.net/xc/ IP 91.234.195.123 ASN #210403 Groupe LWS SARL Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 15:52:47 Last Seen2024-04-16 19:46:01 Times Seen23 Hash 293d9dcfd9b045ef53c5dcd257121826 1181306ac37376134297bd8c8b5abc0074b0ec24 5d99453f0989f7bdd4937f7410ed00424920a361f0f9ce726222f6b3ca87382a Loading...

	rsirdc.net/xc/	84 B	2023-03-13	2024-04-18
Pretty URL rsirdc.net/xc/ IP 91.234.195.123 ASN #210403 Groupe LWS SARL Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 00:54:59 Last Seen2024-04-18 11:43:16 Times Seen27 Hash a43e171be6db16ed2e87cab1a3086af1 6abf4546aee405cffbeecf70d75b51420f1791b5 3577f385c73ed5a411e3d2e8a20679751d13bf17dca82e76ecdaffcfa44796c2 Loading...

HTTP Transactions (5)

URL IP Response Size

rsirdc.net/xc

91.234.195.123

301 Moved Permanently

230 B

URL User Request GET HTTP/2
rsirdc.net/xc
IP
91.234.195.123:443
ASN
#210403 Groupe LWS SARL

Certificate
IssuerLet's Encrypt
Subjectrsirdc.org
FingerprintAA:8C:2E:42:FA:43:F3:0A:12:68:45:58:96:C9:58:77:94:6E:D7:26
ValidityWed, 03 Apr 2024 16:27:13 GMT - Tue, 02 Jul 2024 16:27:12 GMT

File type
HTML document, ASCII text
Size
230 B (230 bytes)
Hash
e006b2e66486f081bc58f67779288056
1608f9a5a2084048c06b22034efbfb4d2519f2fc
96ea5d2de04b3f0fb96b9c5f2edb6b763e026dd6599a97ea43a5d2416b60a02c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft
OpenPhish	phishing	Outlook

HTTP Headers

GET /xc HTTP/1.1
Host: rsirdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Tue, 16 Apr 2024 17:45:34 GMT
content-type: text/html; charset=iso-8859-1
content-length: 230
location: https://rsirdc.net/xc/
server: fastestcache
edge-cache-engine: varnish
edge-request-id: 56973704098b5143d415e43d5acfe00c
edge-cache-engine-mode: ACTIVE
vary: Accept-Encoding
age: 59
x-request-id: 56973704098b5143d415e43d5acfe00c
edge-cache-engine-hit: HIT
X-Firefox-Spdy: h2

rsirdc.net/owa/auth/15.2.1544/themes/resources/segoeui-regular.ttf

91.234.195.123

404 Not Found

315 B

URL GET HTTP/2
rsirdc.net/owa/auth/15.2.1544/themes/resources/segoeui-regular.ttf
IP
91.234.195.123:443
ASN
#210403 Groupe LWS SARL

Requested by
https://rsirdc.net/xc/
Certificate
IssuerLet's Encrypt
Subjectrsirdc.org
FingerprintAA:8C:2E:42:FA:43:F3:0A:12:68:45:58:96:C9:58:77:94:6E:D7:26
ValidityWed, 03 Apr 2024 16:27:13 GMT - Tue, 02 Jul 2024 16:27:12 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/auth/15.2.1544/themes/resources/segoeui-regular.ttf HTTP/1.1
Host: rsirdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rsirdc.net/xc/
Cookie: PHPSESSID=2dieabmvi264kse3kg80jjujj1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Tue, 16 Apr 2024 17:45:34 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
server: fastestcache
edge-cache-engine: varnish
edge-request-id: f2b174986f06bce4e90622d4890136b0
edge-cache-engine-mode: ACTIVE
age: 0
X-Firefox-Spdy: h2

rsirdc.net/owa/auth/15.2.1544/themes/resources/segoeui-semilight.ttf

91.234.195.123

404 Not Found

315 B

URL GET HTTP/2
rsirdc.net/owa/auth/15.2.1544/themes/resources/segoeui-semilight.ttf
IP
91.234.195.123:443
ASN
#210403 Groupe LWS SARL

Requested by
https://rsirdc.net/xc/
Certificate
IssuerLet's Encrypt
Subjectrsirdc.org
FingerprintAA:8C:2E:42:FA:43:F3:0A:12:68:45:58:96:C9:58:77:94:6E:D7:26
ValidityWed, 03 Apr 2024 16:27:13 GMT - Tue, 02 Jul 2024 16:27:12 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/auth/15.2.1544/themes/resources/segoeui-semilight.ttf HTTP/1.1
Host: rsirdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rsirdc.net/xc/
Cookie: PHPSESSID=2dieabmvi264kse3kg80jjujj1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Tue, 16 Apr 2024 17:45:34 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
server: fastestcache
edge-cache-engine: varnish
edge-request-id: c7713fc1d6775462867194276f27942e
edge-cache-engine-mode: ACTIVE
age: 0
X-Firefox-Spdy: h2

rsirdc.net/owa/auth/15.2.1544/themes/resources/favicon.ico

91.234.195.123

404 Not Found

315 B

URL GET HTTP/2
rsirdc.net/owa/auth/15.2.1544/themes/resources/favicon.ico
IP
91.234.195.123:443
ASN
#210403 Groupe LWS SARL

Requested by
https://rsirdc.net/xc/
Certificate
IssuerLet's Encrypt
Subjectrsirdc.org
FingerprintAA:8C:2E:42:FA:43:F3:0A:12:68:45:58:96:C9:58:77:94:6E:D7:26
ValidityWed, 03 Apr 2024 16:27:13 GMT - Tue, 02 Jul 2024 16:27:12 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/auth/15.2.1544/themes/resources/favicon.ico HTTP/1.1
Host: rsirdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rsirdc.net/xc/
Cookie: PHPSESSID=2dieabmvi264kse3kg80jjujj1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
date: Tue, 16 Apr 2024 17:45:34 GMT
content-type: text/html; charset=iso-8859-1
content-length: 315
server: fastestcache
edge-cache-engine: varnish
edge-request-id: 50185e3a70d8a48de9b6d04b265c956c
edge-cache-engine-mode: ACTIVE
age: 0
X-Firefox-Spdy: h2

rsirdc.net/xc/

91.234.195.123

200 OK

63 kB

URL User Request GET HTTP/2
rsirdc.net/xc/
IP
91.234.195.123:443
ASN
#210403 Groupe LWS SARL

Certificate
IssuerLet's Encrypt
Subjectrsirdc.org
FingerprintAA:8C:2E:42:FA:43:F3:0A:12:68:45:58:96:C9:58:77:94:6E:D7:26
ValidityWed, 03 Apr 2024 16:27:13 GMT - Tue, 02 Jul 2024 16:27:12 GMT

File type
HTML document, ASCII text, with very long lines (10416)
Size
63 kB (62821 bytes)
Hash
45e76047259dba36da5d19417f8f137c
3bd992a97b401b2ac391e4138ab06f88617eecd4
0593d9a56e5b515e9c4d8c3265410c968f649b716ca8c58ff19153a583eed00e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /xc/ HTTP/1.1
Host: rsirdc.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 17:45:34 GMT
content-type: text/html; charset=UTF-8
server: fastestcache
edge-cache-engine: varnish
edge-request-id: 9cb168e914570ba7af171f176f58e3f9
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=2dieabmvi264kse3kg80jjujj1; path=/
vary: Accept-Encoding
edge-cache-engine-mode: ACTIVE
age: 0
accept-ranges: bytes
x-request-id: 9cb168e914570ba7af171f176f58e3f9
edge-cache-engine-hit: MISS
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections