Report - aiitpune.com/js/lzjl/Z2lsYmVydC5zdGVnZXJAcmV2YWwuY29t

Report Overview

Submitted URL
aiitpune.com/js/lzjl/Z2lsYmVydC5zdGVnZXJAcmV2YWwuY29t
IP
132.148.128.8
ASN
#398101 GO-DADDY-COM-LLC
Submitted
2024-04-16 06:09:51
Access
public
Website Title
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
Final URL
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
Tags
phishing microsoft outlook
urlquery detections
Phishing - Microsoft Outlook

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
aiitpune.com	unknown	2013-02-06	2017-08-24	2024-04-15	507 B	294 B	132.148.128.8
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2024-04-15	1.8 kB	22 kB	104.17.2.184
dc3889e1.b24b366159a504c34a2004dc.workers.dev	unknown	2019-02-08	2024-04-11	2024-04-15	1.0 kB	16 kB	172.67.139.22
mailvirginmobileiphone.com	unknown	2024-01-10	2024-04-11	2024-04-16	2.2 kB	9.8 kB	51.161.109.46

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (38)

		Size	First Seen	Last Seen
	#1 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07	2024-04-29
Pretty Observations First Seen2023-03-07 01:03:43 Last Seen2024-04-29 21:04:05 Times Seen350636 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#2 Eval - a77ef7b2b1aff8e637931910c07572bc	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash a77ef7b2b1aff8e637931910c07572bc 52bc8466979631af10809cd9fe4187a166594b15 1f8e26976c6a662a17aad63d2280d8e7ac8ce971b9f6ca1e3c1ce5caa9c4c302 Loading...

	#3 Eval - 6492115a147648a50ba7f116c321c1d0	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 6492115a147648a50ba7f116c321c1d0 afd55f742869e76daca1b42763f3a69e0924f2d3 45aede8a281340d9249d992247daf692565d6ef140324fd61751ea7e3e4c2b5b Loading...

	#4 Eval - f4602d55d0f57fbca10b4487b93cc142	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash f4602d55d0f57fbca10b4487b93cc142 6ae776f893a415bb008d739b9e58ae007575bf86 5eb73a31ac64889e4ca4139dc994d155439738b78a74c8a26fb3b24d5bccb597 Loading...

	#5 Eval - 0cc9be3f6b0ce7b6e38256ffc6a91bc9	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 0cc9be3f6b0ce7b6e38256ffc6a91bc9 a32f5b9677fa7e12dea2daf5edc5da3668351e82 7dd9ece561bf8137300c5ad5acd8a5e69928b10c516b7119975b7cd77c8463ae Loading...

	#6 Eval - 869db4988f9cc43001bc7a956b76ebbe	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 869db4988f9cc43001bc7a956b76ebbe 179b02d3d6eacf7e959db07b1cf746793bad1178 5607e3d4686dbc2ab53ea5b9c8633334ac4a71ae6159e4cbd2f32f5d50f092f2 Loading...

	#7 Eval - e08262f374132876b57bc113579c6220	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash e08262f374132876b57bc113579c6220 d4f532c6db7b0a91dec8a2d59271a6e2b9e8bdff ed19f9a4997bca0e4d89f1e790de35dc43924327bec41355c78749c8e57dee44 Loading...

	#8 Eval - 3711ee5d283f65bd2aaf500240b6efcd	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 3711ee5d283f65bd2aaf500240b6efcd cc6014ec940d6b0323b9cb5837e9cbcb1f964160 dde852f2d0ec30056459f5229d77a01f202dbc2091a32236ba55025191b584be Loading...

	#9 Eval - 611ab8ea4a777cbd8f1711c73d71185c	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 611ab8ea4a777cbd8f1711c73d71185c aa2bfd589acac85d1c78dc346878f03541db399e 2efcd0cf9e84a46f3a106cb81a9b9966349d50003b2960b21cff18206b378749 Loading...

	#10 Eval - 9684d64367314244e79c841c158050ce	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 9684d64367314244e79c841c158050ce bf04c3e66013e1fdfe15fd8e01302d075a3df688 b004855976fc499aa0711d9110ed933c54fbd1a304796c760d5ac618c77c0d18 Loading...

	#11 Eval - 50e356ffc38894999cf9729ba51129cb	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 50e356ffc38894999cf9729ba51129cb 7ea52f180ae7735d1cfe5c8a6b25c3c65b9c7444 e3a616154d784ca584f9d362dc01b96c1cd538a262dcd257f21ad08a37d71a84 Loading...

	#12 Eval - 00cc80e42620e7cc25a66ef72923eb71	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 00cc80e42620e7cc25a66ef72923eb71 d1a2a8bb1b4ba0ccde883bb8a03cde53b53bb2f1 ca65d1ebe35e38df5518065fa348dcb3cdacb2ba245f29bdf3827fc87d7ff541 Loading...

	#13 Eval - a2b2cf284f28e47cbb30bac7afd03417	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash a2b2cf284f28e47cbb30bac7afd03417 f7aa91e618cb4ca468809669a69900dd29831b36 4059e83efb5b068ee24901fb41d5689d1a0b17f9ce4c8a706f55fa8e714862cd Loading...

	#14 Eval - 17d2c5bd1bcf3e9f4efe960c0b6baa35	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 17d2c5bd1bcf3e9f4efe960c0b6baa35 0e9d899f86faed2d9b6198341361640ec95febc1 73d0e43fa3c059bd862ceaefd0c5e105fb574b6c3fc5cab91924f7bfb20e371f Loading...

	#15 Eval - 0a7f9c8d2b879b9c53e87018950a0546	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 0a7f9c8d2b879b9c53e87018950a0546 dc81ded184f85b15b13228802ddcb776292567de 3f09bbe4ee6a3ca5dab8d44632fd98b7d223790c891554f5b392222a5511b857 Loading...

	#16 Eval - ada2d4d8e6881183a54442dabf8922f2	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash ada2d4d8e6881183a54442dabf8922f2 583d804a1c85500f62f4773be0be0900f0477af6 88e9864d3e0d93984b44b5dffc7e61d5b38c285a626311cfb23476df659226b5 Loading...

	#17 Eval - d425a57ac7cfab9e8613289e7815006e	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash d425a57ac7cfab9e8613289e7815006e 38219b87c1359861d085802efa7d3dff2f2cc1cd 0456af782748c41513ebf82914c357098ea39bee1c8e48de5baa6eb6c71b69f3 Loading...

	#18 Eval - 1dc47689b37eff351054e44007d55efb	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 1dc47689b37eff351054e44007d55efb 689efe2c9564748e9ddb96b97f8a862a22eefcc2 88778596b82a598ecb9bc2349ef744988bf2069fb24203fdaf012559f1dcca00 Loading...

	#19 Eval - 45143e619c8ad5d300954eb358810b5e	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 45143e619c8ad5d300954eb358810b5e 94676356a42358ffa19b8e264c5474331e694c43 60afe7cffa64c53569e40643cf6b4e7e38313962dfe724962b75b1fa0f3303d4 Loading...

	#20 Eval - 0942aa06489a875bed9761e3a9564fc6	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 0942aa06489a875bed9761e3a9564fc6 2ed3c81203dee6616019bead3d3e5b73f6cfb1b5 239182786bf5b03f3404c2ae332538844fcbf5dbe476c6842a2dbadf8da5cf30 Loading...

	#21 Eval - 337b0731a69575556435af2c2183b99a	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 337b0731a69575556435af2c2183b99a 6cc733de2a560f131e2cb5a786897ecfc4183f21 d229a92e9ad3db674ecb505780f758a4dc093f7d035a5a49dd0937ad76d61f0f Loading...

	#22 Eval - 2ca86a7506458986376fadf1b5f6255b	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 2ca86a7506458986376fadf1b5f6255b b8163738c3b95543e5d88bf6c691a8c11ed757a5 20c259b2f6e36354c392138861c323848b22573463ec44241b5aa35e1d7d299e Loading...

	#23 Eval - 88a7cc373954b0a44eeaffb608efc2a8	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 88a7cc373954b0a44eeaffb608efc2a8 27e31ad91d30e3ac01d7e6efa77a3ce98c04a457 a42055e1f798da3b472b22281c84775b88b45c168954c4a91b8f4acc8f911f1e Loading...

	#24 Eval - 16d98a84401c8344814bb706973d0e3b	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 16d98a84401c8344814bb706973d0e3b 9af281a0482c9aa13622199bf0c635a08fad44b9 de7872e0cfdd6e13694abaffd9388152a52a7af1c2017c4832121cd947767a4d Loading...

	#25 Eval - d0557c6634af15cc856802e9893d66c2	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash d0557c6634af15cc856802e9893d66c2 c1ed9f72d71b344b22027f1fc5355d4b8ebb2e89 304b9e95b907ec20c6a64134ccdf9cb94d56f101125e775fd9a19ae8a1c99712 Loading...

	#26 Eval - 5fe05feb6aed7a454215ba15966d0945	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 5fe05feb6aed7a454215ba15966d0945 66e7fd11253c08a15e5822e7a335160b862fd7cb f20b5aa636d6e7509d0ebd0706d2723ea3c85eb5218735991df5176ddcd1cac3 Loading...

	#27 Eval - 1fe73e00b85159b6257d3a97d16bcce0	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:52 Last Seen2024-04-16 08:09:52 Times Seen1 Hash 1fe73e00b85159b6257d3a97d16bcce0 312a08e8c701ac5b2ec6294aac27601f456f8447 07335edbea7bb6b10dade6fb7ecb32d513ec529c2d527cc1f6526ad7be65bba9 Loading...

	#28 Eval - ac6d43b49aec2f87daf340337b6a7882	60 B	2024-04-04	2024-04-17
Pretty Observations First Seen2024-04-04 12:28:09 Last Seen2024-04-17 16:04:31 Times Seen3428 Hash ac6d43b49aec2f87daf340337b6a7882 d3874a31a6b7fe11121edc3ed80fdc8b66f6589a 1af55b64e0b39e0f5f760a8050b284a66fe404ddff945697590f8240798311b2 Loading...

	#29 Eval - 5966595f81aa8d78e32245ba3a222b9c	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 5966595f81aa8d78e32245ba3a222b9c 349d2d57ae1024dfd0b6fda27e5509428f7acb44 072fa30a53ead90aee1fcc904021c2b9bf262991514a94e7ee5ba9d60564b031 Loading...

	#30 Eval - 782c43ac827d0a8e34cd2f1f16f769d0	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 782c43ac827d0a8e34cd2f1f16f769d0 82023eef2d4d561f8a113d92ba88714eeb1e7170 177cf5e87071f4cb52a07fac01a0df015ad14890ec0e2fe2824e38411fb629ba Loading...

	#31 Eval - e621ee8cf210c474e973ce2be51d9967	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash e621ee8cf210c474e973ce2be51d9967 224e3970219078bb1dba9f110389370abbf0693d c567382a7325e240336e15b9ca76eb205a0d86f5c2284a1fe291556354a33926 Loading...

	#32 Eval - fd0715323fe83d5ed95e02045b97edaf	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash fd0715323fe83d5ed95e02045b97edaf af4b946a28d9b778185ca57685a210deae966ec3 bcc0d9ab88c6a10ba019f0dd29b4dce00f1b11f719cccf1aa8efce0fcbe14d11 Loading...

	#33 Eval - 8bc2796496c6a6f9a9ddea253ff11c9e	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 8bc2796496c6a6f9a9ddea253ff11c9e b554413718fd21d0cd236845bd9d91ddf13f3946 20721cc13f0125f646efafb69c809fd960d8f48ce29ded522690a124de120270 Loading...

	#34 Eval - 2906bbf5c9b5c3a76df188d3a5abadd7	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 2906bbf5c9b5c3a76df188d3a5abadd7 3b724c0145a256bf3fcbc81173871d2824cfc758 6f2a04957cd88f3b251c05ac96927f65b37544b9bebd20789884f6123c1e0839 Loading...

	#35 Eval - e83678cbef17dd6795b544b787e5e241	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash e83678cbef17dd6795b544b787e5e241 160804cedbfb1f4bbf8c7d29fd0e9eaced0fe94f 23151fccc1343ded65627d95f5c135057c4354c6ee41cbd09feaf8512b4c6022 Loading...

	#36 Eval - 8f03a6b3f8cda06db32d11f22371d153	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 8f03a6b3f8cda06db32d11f22371d153 68f62a85f2b614c22b3699799a88f75d778626af 0ee31b8eb494e724e13ca01ec3604d9a283e4163a56f0037a4b69b93da7d9b81 Loading...

	#37 Eval - 69fae02f6092dd24da7dacfa20739a96	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash 69fae02f6092dd24da7dacfa20739a96 8098d1bcb55677b02246e2de589dc19b656284c1 e4a9856f8f6f54c4d035c411978cc6e76c9bca5f0439f1b209079c64241eb5e8 Loading...

	#38 Eval - e7ddaf0e502a498dfafd7febb5dcd937	28 B	2024-04-16	2024-04-16
Pretty Observations First Seen2024-04-16 08:09:53 Last Seen2024-04-16 08:09:53 Times Seen1 Hash e7ddaf0e502a498dfafd7febb5dcd937 35a4901d68e188ac78ec1f45da780a469c507f38 8c942c457a3ec61b7997e8673a2a009bcaaf9c89c409af92898ca81ddf2e0e50 Loading...

HTTP Transactions (9)

URL IP Response Size

aiitpune.com/js/lzjl/Z2lsYmVydC5zdGVnZXJAcmV2YWwuY29t

132.148.128.8

0 B

URL
aiitpune.com/js/lzjl/Z2lsYmVydC5zdGVnZXJAcmV2YWwuY29t
IP
132.148.128.8:0
ASN
#398101 GO-DADDY-COM-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /js/lzjl/Z2lsYmVydC5zdGVnZXJAcmV2YWwuY29t HTTP/1.1
Host: aiitpune.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 16 Apr 2024 06:09:27 GMT
Server: Apache
refresh: 0;url=https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.17.2.184

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 16 Apr 2024 06:09:27 GMT
content-length: 0
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback
access-control-allow-origin: *
cache-control: max-age=300, public
vary: Accept-Encoding
server: cloudflare
cf-ray: 875201b34c9956b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback

104.17.2.184

14 kB

URL
challenges.cloudflare.com/turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (40613)
Size
14 kB (14270 bytes)
Hash
d1048a66fc11ea28c3cb1488fac82c62
f055707cf91f637ec19bf5e65bf378857e798469
8f1ad19042c2f9ee60c2de21f37f788af7b1ecccda8eec1d877f9b9c0e994370

HTTP Headers

GET /turnstile/v0/b/bcc5fb0a8815/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 06:09:27 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 875201b35caa56b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com

172.67.139.22

200 OK

12 kB

URL User Request POST HTTP/3
dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
IP
172.67.139.22:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectb24b366159a504c34a2004dc.workers.dev
FingerprintBC:41:71:93:F8:C2:C5:7E:66:EE:C8:3A:E4:16:06:3D:23:73:EE:5F
ValidityThu, 11 Apr 2024 15:41:38 GMT - Wed, 10 Jul 2024 15:41:37 GMT

File type
HTML document, ASCII text, with very long lines (3255), with no line terminators
Size
12 kB (11721 bytes)
Hash
11482519dc727778115f3fcbfb28d1c7
633fb6ec307a6964e5c8a9b322bdcbcca243e30a
c9b17fb76673bd8a3ed7134667afe1324e9d3eb9a1561d021d10d3696db4b0e4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?qrc=gilbert.steger@reval.com HTTP/1.1
Host: dc3889e1.b24b366159a504c34a2004dc.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 06:09:27 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jdqX%2BoYeJIxnOnnD2%2BfiibTaIrc905%2Fye7ZbFzrLiOmCTtgQbZf7jAKSB1FLW%2FL5eySBVrrmS1NVCQ7dR3xZEFupXc6GlxoLNPO8tF6t3ZHCOw85g7ze%2Fd9uGm3HZgAGwqELCSwCUoCEcjQ0U7Vx1A2nXpUggD%2FIcS%2BMandcd78%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875201b28f8a5691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/382543787:1713245408:mdtB6op3-Jgt1d6pC3p7-3Lcfb4ySPp1AQtQ-v7IowU/875201b3ea4e56c3/74cdf331631b4ca

104.17.2.184

6.6 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/382543787:1713245408:mdtB6op3-Jgt1d6pC3p7-3Lcfb4ySPp1AQtQ-v7IowU/875201b3ea4e56c3/74cdf331631b4ca
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (976), with no line terminators
Size
6.6 kB (6649 bytes)
Hash
79049a753ee2df106d641c830c6359b0
f52f31afe0e28623e879909bf3d63de7e205bcb5
f14f037058a0e6aa09746389788ba4f9da15db351334418b3042ea827d1964d8

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/382543787:1713245408:mdtB6op3-Jgt1d6pC3p7-3Lcfb4ySPp1AQtQ-v7IowU/875201b3ea4e56c3/74cdf331631b4ca HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/6bkdp/0x4AAAAAAAW6FMm8tl7BXPFe/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 74cdf331631b4ca
Content-Length: 37263
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 06:09:33 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: dD1FbtVEoZLAuub9Zy2o6zUiMBob0U6wxAOP73fmoX/ma4e3nBIDCuL1UzcOmV3RkROSUH6uNlDboWf03aOm2tKyPREtU7KKfrfGMXtnWRg=$cSHZVQgR9kJLSASsuIzFOA==
cf-chl-out-s: 9JF7b/pbqO1ahzHV8anDZ+Ij4IZv660Y/EbFuMYuGrDp7tEOezTL2sbJxpBhviZFjsGiIZsP0L3unGHRQfRVCSizgEbZamjg8veYMY1tve8B+0x97rSczpKNAmSbgVIeTeMOv/Hx7rOeEeG2gVF/LA==$6/l0nZAEKPPnHZiRCEHPAQ==
server: cloudflare
cf-ray: 875201d5aa1056c3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

mailvirginmobileiphone.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWx2aXJnaW5tb2JpbGVpcGhvbmUuY29tIiwiZG9tYWluIjoibWFpbHZpcmdpbm1vYmlsZWlwaG9uZS5jb20iLCJrZXkiOiJQQzhMNUxkRmZVME8iLCJxcmMiOiJnaWxiZXJ0LnN0ZWdlckByZXZhbC5jb20iLCJpYXQiOjE3MTMyNDc3ODcsImV4cCI6MTcxMzI0NzkwN30.TCUzQ5ALxfHhkTRMg4rirviIkxm5xbS-Y8SjoZPY5nU

51.161.109.46

0 B

URL GET
mailvirginmobileiphone.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWx2aXJnaW5tb2JpbGVpcGhvbmUuY29tIiwiZG9tYWluIjoibWFpbHZpcmdpbm1vYmlsZWlwaG9uZS5jb20iLCJrZXkiOiJQQzhMNUxkRmZVME8iLCJxcmMiOiJnaWxiZXJ0LnN0ZWdlckByZXZhbC5jb20iLCJpYXQiOjE3MTMyNDc3ODcsImV4cCI6MTcxMzI0NzkwN30.TCUzQ5ALxfHhkTRMg4rirviIkxm5xbS-Y8SjoZPY5nU
IP
51.161.109.46:0
ASN
#16276 OVH SAS

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL21haWx2aXJnaW5tb2JpbGVpcGhvbmUuY29tIiwiZG9tYWluIjoibWFpbHZpcmdpbm1vYmlsZWlwaG9uZS5jb20iLCJrZXkiOiJQQzhMNUxkRmZVME8iLCJxcmMiOiJnaWxiZXJ0LnN0ZWdlckByZXZhbC5jb20iLCJpYXQiOjE3MTMyNDc3ODcsImV4cCI6MTcxMzI0NzkwN30.TCUzQ5ALxfHhkTRMg4rirviIkxm5xbS-Y8SjoZPY5nU HTTP/1.1
Host: mailvirginmobileiphone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Set-Cookie: qPdM=PC8L5LdFfU0O; path=/; samesite=none; secure; httponly
qPdM.sig=z9BRbJQ0aGcs3YiG4OdbIpivbQg; path=/; samesite=none; secure; httponly
location: /?qrc=gilbert.steger%40reval.com
Date: Tue, 16 Apr 2024 06:09:48 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

mailvirginmobileiphone.com/?qrc=gilbert.steger%40reval.com

51.161.109.46

0 B

URL GET
mailvirginmobileiphone.com/?qrc=gilbert.steger%40reval.com
IP
51.161.109.46:0
ASN
#16276 OVH SAS

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?qrc=gilbert.steger%40reval.com HTTP/1.1
Host: mailvirginmobileiphone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=PC8L5LdFfU0O; qPdM.sig=z9BRbJQ0aGcs3YiG4OdbIpivbQg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://mailvirginmobileiphone.com/owa/?login_hint=gilbert.steger%40reval.com
Server: Microsoft-IIS/10.0
request-id: 38220150-c80b-9e92-1f20-146b47c27ff4
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: PR1P264CA0076, PR1P264CA0076
X-RequestId: e8713054-3dd9-473b-af20-e276f8721e0d
X-FEProxyInfo: PR1P264CA0076.FRAP264.PROD.OUTLOOK.COM
X-FEEFZInfo: CDG
MS-CV: UAEiOAvIkp4fIBRrR8J/9A.0
X-Powered-By: ASP.NET
Date: Tue, 16 Apr 2024 06:09:48 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

mailvirginmobileiphone.com/owa/?login_hint=gilbert.steger%40reval.com

51.161.109.46

1.4 kB

URL GET
mailvirginmobileiphone.com/owa/?login_hint=gilbert.steger%40reval.com
IP
51.161.109.46:0
ASN
#16276 OVH SAS

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com

File type
HTML document, ASCII text, with very long lines (814), with CRLF, LF line terminators
Size
1.4 kB (1394 bytes)
Hash
453039b967ee9cf5bcd8fdb7b5078230
0d95ac3329b7d58a03431b90f82b0f753947ce7c
fb87444ef530bc2ebbecc516bf024fa80c20d054ce3db1dd1d7a9a3c53a6e128

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /owa/?login_hint=gilbert.steger%40reval.com HTTP/1.1
Host: mailvirginmobileiphone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=PC8L5LdFfU0O; qPdM.sig=z9BRbJQ0aGcs3YiG4OdbIpivbQg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
content-length: 1394
Content-Type: text/html; charset=utf-8
Location: https://mailvirginmobileiphone.com/?2e3q8az7x=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1naWxiZXJ0LnN0ZWdlciU0MHJldmFsLmNvbSZjbGllbnQtcmVxdWVzdC1pZD0wOTI5ZWFkOC1hYzVlLTM1NGEtMDk3Ny03MDQ1OTBlZmRlNDgmcHJvdGVjdGVkdG9rZW49dHJ1ZSZjbGFpbXM9JTdiJTIyaWRfdG9rZW4lMjIlM2ElN2IlMjJ4bXNfY2MlMjIlM2ElN2IlMjJ2YWx1ZXMlMjIlM2ElNWIlMjJDUDElMjIlNWQlN2QlN2QlN2Qmbm9uY2U9NjM4NDg4NDQ1ODk3MTg1MTM5LmI4NjAxY2IxLWI2MzAtNGY4Yy04NWIwLThmODllZTA1OGE5ZCZzdGF0ZT1EY3RORHNJZ0VFQmgwTE80TXRBaF9IUllOQjdGQUU2UkJFdUN4RjVmRnRfYlBjNFl1MDZYaWNNTVc1MUdnMmlNUmI4cXRFcDdHZEdCU2xHSjZEUUlzMk1TYUNNSTNORVRnY1hnWDN5LTk2V2RZWG5VbHN2eGZKZGpiTG5VU0gzSTc2Qk1fV2FnMHk5VW1kcm5Edw==
Server: Microsoft-IIS/10.0
request-id: 0929ead8-ac5e-354a-0977-704590efde48
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedFETarget: YT4PR01CU003.internal.outlook.com
X-BackEndHttpStatus: 302, 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=14AB7FDB113147FABCC31E7C6296E338; expires=Wed, 16-Apr-2025 06:09:49 GMT; path=/;SameSite=None; secure
ClientId=14AB7FDB113147FABCC31E7C6296E338; expires=Wed, 16-Apr-2025 06:09:49 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Wed, 16-Oct-2024 06:09:49 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.nonce.v3.nQq57SF79wh8v3fTMd-2Rj7YdYTRmCBP8tatMdmW-gU=638488445897185139.b8601cb1-b630-4f8c-85b0-8f89ee058a9d; expires=Tue, 16-Apr-2024 07:09:49 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OptInPrg=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
ClientId=14AB7FDB113147FABCC31E7C6296E338; expires=Wed, 16-Apr-2025 06:09:49 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Wed, 16-Oct-2024 06:09:49 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=mailvirginmobileiphone.com; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OpenIdConnect.nonce.v3.nQq57SF79wh8v3fTMd-2Rj7YdYTRmCBP8tatMdmW-gU=638488445897185139.b8601cb1-b630-4f8c-85b0-8f89ee058a9d; expires=Tue, 16-Apr-2024 07:09:49 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
OptInPrg=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 16-Apr-1994 06:09:49 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14Bc5fk0ttd3Ag; expires=Tue, 16-Apr-2024 12:11:49 GMT; path=/;SameSite=None; secure; HttpOnly
X-CalculatedBETarget: YT3PR01MB5432.CANPRD01.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS7
X-OWA-DiagnosticsInfo: 1;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-04-16T06:09:49.718
X-BackEnd-End: 2024-04-16T06:09:49.718
X-DiagInfo: YT3PR01MB5432
X-BEServer: YT3PR01MB5432
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
X-Proxy-BackendServerStatus: 302
X-FEProxyInfo: YQBPR0101CA0323.CANPRD01.PROD.OUTLOOK.COM
X-FEEFZInfo: YQB
X-FEServer: YT4PR01CA0064, YQBPR0101CA0323
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-FirstHopCafeEFZ: YQB
Date: Tue, 16 Apr 2024 06:09:49 GMT
Connection: close
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

dc3889e1.b24b366159a504c34a2004dc.workers.dev/favicon.ico

172.67.139.22

200 OK

3.3 kB

URL GET HTTP/3
dc3889e1.b24b366159a504c34a2004dc.workers.dev/favicon.ico
IP
172.67.139.22:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
Certificate
IssuerGoogle Trust Services LLC
Subjectb24b366159a504c34a2004dc.workers.dev
FingerprintBC:41:71:93:F8:C2:C5:7E:66:EE:C8:3A:E4:16:06:3D:23:73:EE:5F
ValidityThu, 11 Apr 2024 15:41:38 GMT - Wed, 10 Jul 2024 15:41:37 GMT

File type
HTML document, ASCII text, with very long lines (3271), with no line terminators
Size
3.3 kB (3255 bytes)
Hash
ade935fdb28f6baa87d11e6a17499976
959d967f84b0c84423c25be6a41565929327f4c1
d4f7590edfe99b50c22b6d0a64768f419a2654233a88bdfd7fc3e9150ab9314c

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: dc3889e1.b24b366159a504c34a2004dc.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dc3889e1.b24b366159a504c34a2004dc.workers.dev/?qrc=gilbert.steger@reval.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 06:09:48 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=024IncVn3s%2FkUnjSPaN8CxrlspR2CJDkS1zp%2FiYItP4QSq0YRvLczE3mfG5WsM8h%2BjLrLzyktfit5nWHismau7wDGQq99d7nj24u1qcJoKHXET0h%2FfORxPHVpTeFtwOeCRYEJaQVr4F1usPWnfdt18Tc8n8nrRhu%2BjKfRaRdz6c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875202337f7856c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (38)

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash