Report - mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv

Report Overview

Submitted URL
mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv
IP
82.221.136.24
ASN
#50613 Advania Island ehf
Submitted
2024-04-26 01:18:50
Access
public
Website Title
Sign in to your Microsoft account
Final URL
signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
8
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
mailytds.com	unknown	unknown	No data	No data	2.5 kB	4.9 kB	82.221.136.24
mtd.mailytds.com	unknown	2024-04-14	2024-04-14	2024-04-15	618 B	519 B	82.221.136.24
signon.mailytds.com	unknown	unknown	No data	No data	4.3 kB	1.3 MB	82.221.136.24
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-24	1.4 kB	68 kB	104.17.25.14
maxcdn.icons8.com	80847	2011-10-04	2015-06-22	2024-04-22	993 B	75 kB	185.76.9.21
use.fontawesome.com	942	2012-10-18	2017-01-30	2024-04-24	440 B	1.3 MB	172.67.142.245

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-05-05
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-05-05 20:49:58 Times Seen141639 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/js/bootstrap.bundle.min.js	81 kB	2023-03-07	2024-05-05
Pretty URL cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/js/bootstrap.bundle.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:22 Last Seen2024-05-05 19:45:34 Times Seen2367 Hash 7fd2f04e75bd7ab1a79d80cdd4c33085 e02a14457b25e6df2568b772feab4387c00a4934 5edf297381b409d711bc8d27676951a59e151e783412850332519c05243d1e24 Loading...

	signon.mailytds.com/assets/js/script.min.js	3.0 kB	2024-04-04	2024-04-26
Pretty URL signon.mailytds.com/assets/js/script.min.js IP 82.221.136.24 ASN #50613 Advania Island ehf Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-04 21:31:08 Last Seen2024-04-26 03:18:56 Times Seen6 Hash 51c277bfe4736ed0ecda1578ad24889b f9376d6c5f811c39664b62ddec893be011235bc8 29b9c21731ed5dc6eee55b03dd41d6740ccb2927b74c6322b3093c33304f8850 Loading...

	signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65	0 B	2023-03-07	2024-05-05
Pretty URL signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65 IP 82.221.136.24 ASN #50613 Advania Island ehf Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-05 21:12:01 Times Seen37370423 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (18)

URL IP Response Size

mailytds.com/

82.221.136.24

707 B

URL
mailytds.com/
IP
82.221.136.24:0
ASN
#50613 Advania Island ehf

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
707 B (707 bytes)
Hash
1304294c0823ca486542ba408ed761e3
b2a70fb2d810ca13985882e6981f33998823e83e
3bbe72f3baa8ec61de17a1d767fca58704769684b7abe9161d0c4eaf4c8f0982

HTTP Headers

GET / HTTP/1.1
Host: mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
content-length: 707
date: Fri, 26 Apr 2024 01:18:24 GMT
server: LiteSpeed
location: https://mailytds.com/

mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv

82.221.136.24

1.4 kB

URL
mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv
IP
82.221.136.24:0
ASN
#50613 Advania Island ehf

File type
HTML document, ASCII text, with very long lines (476)
Size
1.4 kB (1370 bytes)
Hash
e4cba50613af2cf2c34986b98be221a0
8a9e249ffd2adc0b99a391c6b7ed3fb6a770a868
5a07762f1ac3ae719f340c22de5f0a142212d96464324a8f54fdf0747be5acb1

HTTP Headers

GET /mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv HTTP/1.1
Host: mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
set-cookie: mailster=8ab7ce30ba7fe239ae12279f7346f073; expires=Fri, 26 Apr 2024 02:18:32 GMT; Max-Age=3600; path=/; secure
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-length: 1370
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 01:18:32 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

mailytds.com/favicon.ico

82.221.136.24

1.2 kB

URL
mailytds.com/favicon.ico
IP
82.221.136.24:0
ASN
#50613 Advania Island ehf

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
1.2 kB (1238 bytes)
Hash
0bde7d4b3da67537eaf9188e6f8049cf
64300fc482d01d38b40ab20e15960b6509665e5a
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv
Cookie: mailster=8ab7ce30ba7fe239ae12279f7346f073
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1238
date: Fri, 26 Apr 2024 01:18:32 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

82.221.136.24

307 Temporary Redirect

0 B

URL User Request GET HTTP/2
mailytds.com/mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv?autoclickprevention=redirect
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /mailster/544/8ab7ce30ba7fe239ae12279f7346f073/aHR0cHM6Ly9tdGQubWFpbHl0ZHMuY29tL1lUTnlTVXR0Vms5S09GVjVTbTVITHpKMWFERXlaejA5L2E2MTAxODQ0Zjk0ZjYwZTBlMmI5MzI4NTgzZGZjNzMzNGRjMmQxNzA2OTlkMzViMTE4NTgzNTE3MDFlZDA0N2E4NzhhZmU3NjdlNzUzNzEwNGZjMThmMzg0NWM0Njk4OTYzZjYv?autoclickprevention=redirect HTTP/1.1
Host: mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: mailster=8ab7ce30ba7fe239ae12279f7346f073
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 307 Temporary Redirect
content-type: text/html; charset=UTF-8
set-cookie: mailster=8ab7ce30ba7fe239ae12279f7346f073; expires=Fri, 26 Apr 2024 02:18:39 GMT; Max-Age=3600; path=/; secure
x-redirect-by: Mailster
location: https://mtd.mailytds.com/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/a6101844f94f60e0e2b9328583dfc7334dc2d170699d35b11858351701ed047a878afe767e7537104fc18f3845c4698963f6/
content-length: 0
date: Fri, 26 Apr 2024 01:18:39 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

mtd.mailytds.com/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/a6101844f94f60e0e2b9328583dfc7334dc2d170699d35b11858351701ed047a878afe767e7537104fc18f3845c4698963f6/

82.221.136.24

302 Found

0 B

URL User Request GET HTTP/2
mtd.mailytds.com/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/a6101844f94f60e0e2b9328583dfc7334dc2d170699d35b11858351701ed047a878afe767e7537104fc18f3845c4698963f6/
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/a6101844f94f60e0e2b9328583dfc7334dc2d170699d35b11858351701ed047a878afe767e7537104fc18f3845c4698963f6/ HTTP/1.1
Host: mtd.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
set-cookie: PHPSESSID=58c556b7ad581b4afae19331a7e0bd90; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
content-type: text/html; charset=UTF-8
content-length: 0
date: Fri, 26 Apr 2024 01:18:39 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65

82.221.136.24

200 OK

1.7 kB

URL User Request GET HTTP/2
signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
1.7 kB (1709 bytes)
Hash
e0e8c78d6e880ee726003b678e68a192
6fe97ae1f1a2005fdb80a6be7153797c0ff16b8f
973533aeea426fe9e2f03df70a62d079789f269a1b9ab35e7addc0e309151a3a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65 HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
set-cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 1709
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/bootstrap.min.css

104.17.25.14

200 OK

18 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/css/bootstrap.min.css
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65324)
Size
18 kB (17522 bytes)
Hash
3afe15e976734d9daac26310110c4594
4f14a09a606c99a11f8fda15564ef66f70402826
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

HTTP Headers

GET /ajax/libs/twitter-bootstrap/4.5.0/css/bootstrap.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: text/css; charset=utf-8
content-length: 17522
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5ebae359-27293"
last-modified: Tue, 12 May 2020 17:56:41 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 896470
expires: Wed, 16 Apr 2025 01:18:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gLX%2FBkLAQ5l1sETBTS86P9Qn6GcFa9eaFtBDITwB0m9xCmX0mAYGyE2dblVsg3gTcT3mVuslLu0kVL7YmgWAe7wCLv0auWGoLrdn%2FwvNkuDq68Ah25bxnDUsOWJp%2BxpwsRsEppgp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a2bd850956568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/js/bootstrap.bundle.min.js

104.17.25.14

200 OK

19 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.5.0/js/bootstrap.bundle.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65297)
Size
19 kB (19084 bytes)
Hash
7fd2f04e75bd7ab1a79d80cdd4c33085
e02a14457b25e6df2568b772feab4387c00a4934
5edf297381b409d711bc8d27676951a59e151e783412850332519c05243d1e24

HTTP Headers

GET /ajax/libs/twitter-bootstrap/4.5.0/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 19084
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5ebae359-13cbc"
last-modified: Tue, 12 May 2020 17:56:41 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 100390
expires: Wed, 16 Apr 2025 01:18:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8V1vMUAp%2BsuSP2zRcduPKVEeXokaxmy%2BA6nVMerbzWjL7dzfLhvVfO3F4EVIDZXz4%2Fnc2cY9wXWXyZ4eSDAXOfnEuxs6F1OPUq%2FyxOkX1ViAGDNkHFJ1HtusIJBTbl95lGWWyJT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a2bd85095a568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

104.17.25.14

200 OK

28 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
28 kB (27958 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 103940
expires: Wed, 16 Apr 2025 01:18:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WVAVOVykVfV2%2B%2B2FTtggQSFMSptPRRwrc0DzbKQKFhaviA%2FSkBAyTTx%2BIXfZIjSf79TEBmnGtpOJT7qmg3LloEk51g4Vixuz35bqmau%2FyLXTf4WZitlzsmB4qiw5PHzximfsZfsn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a2bd85095b568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

signon.mailytds.com/assets/css/styles.min.css

82.221.136.24

200 OK

866 B

URL GET HTTP/2
signon.mailytds.com/assets/css/styles.min.css
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
ASCII text
Size
866 B (866 bytes)
Hash
bc70f094cb5758e3fd3603eeed7d811f
447cbc4391499fa985c716bcc44c74ab0fd3c436
4209a3f5874f1cb74f46253e373d26a86550f88171c4455e86a35f43fbab6049

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/css/styles.min.css HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: text/css
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 866
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

signon.mailytds.com/assets/img/microsoft_logo.svg

82.221.136.24

200 OK

1.4 kB

URL GET HTTP/2
signon.mailytds.com/assets/img/microsoft_logo.svg
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1369 bytes)
Hash
ee5c8d9fb6248c938fd0dc19370e90bd
d01a22720918b781338b5bbf9202b241a5f99ee4
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/img/microsoft_logo.svg HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: image/svg+xml
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 1369
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

signon.mailytds.com/assets/js/script.min.js

82.221.136.24

200 OK

807 B

URL GET HTTP/2
signon.mailytds.com/assets/js/script.min.js
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
ASCII text
Size
807 B (807 bytes)
Hash
51c277bfe4736ed0ecda1578ad24889b
f9376d6c5f811c39664b62ddec893be011235bc8
29b9c21731ed5dc6eee55b03dd41d6740ccb2927b74c6322b3093c33304f8850

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/js/script.min.js HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: application/javascript
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 807
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

maxcdn.icons8.com/fonts/line-awesome/1.1/fonts/line-awesome.woff2?v=1.1.

185.76.9.21

200 OK

45 kB

URL GET HTTP/2
maxcdn.icons8.com/fonts/line-awesome/1.1/fonts/line-awesome.woff2?v=1.1.
IP
185.76.9.21:443
ASN
#60068 Datacamp Limited

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subject1220595937.rsc.cdn77.org
Fingerprint2E:82:38:27:C2:FE:73:2D:3E:E1:E4:EE:34:1B:18:C3:25:F7:EA:F3
ValidityWed, 06 Mar 2024 18:32:30 GMT - Tue, 04 Jun 2024 18:32:29 GMT

File type
Web Open Font Format (Version 2), TrueType, length 45108, version 1.0
Size
45 kB (45108 bytes)
Hash
452a5b42cb4819f09d35bcf6cbdb24c1
4344bf7fdb2b5e538fb4859df945fc1a21d2a83c
063a952901506e6cbcc2abdd1995ea387e4ae9138993f5517834a75faee165d0

HTTP Headers

GET /fonts/line-awesome/1.1/fonts/line-awesome.woff2?v=1.1. HTTP/1.1
Host: maxcdn.icons8.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://signon.mailytds.com
DNT: 1
Connection: keep-alive
Referer: https://maxcdn.icons8.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: font/woff2
content-length: 45108
x-amz-id-2: tne9Dfpc7MOkp8LF1CoMnvV0g0cpwlcYcyTQi8tna76YPj07D2B9vlM3s8Qee8hyi3MflRswV1c=
x-amz-request-id: GH1VX01H3Z92CJZS
last-modified: Mon, 06 Jun 2022 09:58:53 GMT
etag: "452a5b42cb4819f09d35bcf6cbdb24c1"
x-amz-meta-mtime: 1654507811.164297687
server: CDN77-Turbo
access-control-allow-origin: *
x-77-nzt: EQwBuUwJFAH3qh4PAA
x-77-nzt-ray: af585630621d1823f1002b6643a1da29
x-accel-expires: @1714140203
x-accel-date: 1713103431
x-cache: HIT
x-age: 990890
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 990890
accept-ranges: bytes
X-Firefox-Spdy: h2

signon.mailytds.com/assets/img/favicon%20180.svg

82.221.136.24

200 OK

466 B

URL GET HTTP/2
signon.mailytds.com/assets/img/favicon%20180.svg
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
SVG Scalable Vector Graphics image
Size
466 B (466 bytes)
Hash
ccddad5bfb588dfd20fb113c5480b447
004efcaa0a3575ad8112753b55e4a8e41c1a2b95
a5d0a1201d89b08816600858b8d32bf61a77384a5124d6afbfbedb149731a2df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/img/favicon%20180.svg HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: image/svg+xml
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 466
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

signon.mailytds.com/assets/img/favicon%20180.svg

82.221.136.24

200 OK

466 B

URL GET HTTP/2
signon.mailytds.com/assets/img/favicon%20180.svg
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
SVG Scalable Vector Graphics image
Size
466 B (466 bytes)
Hash
ccddad5bfb588dfd20fb113c5480b447
004efcaa0a3575ad8112753b55e4a8e41c1a2b95
a5d0a1201d89b08816600858b8d32bf61a77384a5124d6afbfbedb149731a2df

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/img/favicon%20180.svg HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: image/svg+xml
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 466
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

use.fontawesome.com/releases/v5.12.0/css/all.css

172.67.142.245

200 OK

1.3 MB

URL GET HTTP/2
use.fontawesome.com/releases/v5.12.0/css/all.css
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
ASCII text, with very long lines (56994)
Size
1.3 MB (1307305 bytes)
Hash
500d1a92f875b1d96d37a3a3f8f0438c
703603273f5d5d52eb456d6385e1a68294fbd568
c9b46437d7418e1712daaad6d73fa17c2c6afb5681770c90339c25428415b7fd

HTTP Headers

GET /releases/v5.12.0/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: text/css
cache-control: max-age=31556926
etag: W/"500d1a92f875b1d96d37a3a3f8f0438c"
last-modified: Fri, 22 Sep 2023 01:45:03 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2473587
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9CyqANrlUFyr9xKKglc23gOHYvoh7SDPfB3FWl2mzV8bmBeosVoA83W9JMYYuyZ7LEO3JJ3alk3LzbmYtVtXF8K1LmqdjMuvEa%2Fif7f4ulkImzHMTgdpp6at7jBRFmQehH%2BGctBP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a2bd851b8556b4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

signon.mailytds.com/assets/img/background.png

82.221.136.24

200 OK

1.3 MB

URL GET HTTP/2
signon.mailytds.com/assets/img/background.png
IP
82.221.136.24:443
ASN
#50613 Advania Island ehf

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subjectmailytds.com
FingerprintA9:83:A8:B1:DB:5A:8C:39:3A:CF:87:79:C3:0B:EF:B4:3A:9D:8C:F7
ValiditySun, 14 Apr 2024 09:23:00 GMT - Sat, 13 Jul 2024 09:22:59 GMT

File type
PNG image data, 3840 x 2158, 8-bit/color RGBA, non-interlaced
Size
1.3 MB (1294919 bytes)
Hash
041ce8536cf04f72905eff206779f7bd
29062f207d93d24354053c46714b70e580914ee7
de7d6f4c83f28b18e41e523e3d8906848b67744f4c26a447185fa9405016771e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /assets/img/background.png HTTP/1.1
Host: signon.mailytds.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/assets/css/styles.min.css
Cookie: PHPSESSID=28e7b84ca868cc99fb1f34368f7c2460
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Fri, 03 May 2024 01:18:40 GMT
content-type: image/png
last-modified: Fri, 05 Apr 2024 02:12:10 GMT
accept-ranges: bytes
content-length: 1294919
date: Fri, 26 Apr 2024 01:18:40 GMT
server: LiteSpeed
X-Firefox-Spdy: h2

maxcdn.icons8.com/fonts/line-awesome/1.1/css/line-awesome.min.css

185.76.9.21

200 OK

28 kB

URL GET HTTP/2
maxcdn.icons8.com/fonts/line-awesome/1.1/css/line-awesome.min.css
IP
185.76.9.21:443
ASN
#60068 Datacamp Limited

Requested by
https://signon.mailytds.com/u/o/p/office/signon/YTNySUttVk9KOFV5Sm5HLzJ1aDEyZz09/d8f859c497c82c25531281fae90751532ec3ccfbc10feb6aa438da26aec4ae6a1a13d3f0bcd56c65
Certificate
IssuerLet's Encrypt
Subject1220595937.rsc.cdn77.org
Fingerprint2E:82:38:27:C2:FE:73:2D:3E:E1:E4:EE:34:1B:18:C3:25:F7:EA:F3
ValidityWed, 06 Mar 2024 18:32:30 GMT - Tue, 04 Jun 2024 18:32:29 GMT

File type
ASCII text, with very long lines (27557)
Size
28 kB (28101 bytes)
Hash
4334c8c70998d81bde3e6765828811a6
de27d3920885be830eba8b77ff1c3b320afc5b98
1e8638f605575bd335d49efa95e165adf7ef06dda8e367661ac2517a0a3a96b4

HTTP Headers

GET /fonts/line-awesome/1.1/css/line-awesome.min.css HTTP/1.1
Host: maxcdn.icons8.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://signon.mailytds.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 01:18:41 GMT
content-type: text/css; charset=utf-8
x-amz-id-2: n12pniSGO2oXIlyBlS5WX0szppUwvLonX5N5nOd7pjMz6gaSIEj8mO8Gl22GGhcaV8XfatKzymo=
x-amz-request-id: 22E18N767CJ1P6MA
last-modified: Mon, 06 Jun 2022 09:58:54 GMT
etag: W/"4334c8c70998d81bde3e6765828811a6"
x-amz-meta-mtime: 1654507817.389231056
server: CDN77-Turbo
access-control-allow-origin: *
x-77-nzt: EQwBuUwJFAH33+QHAA
x-77-nzt-ray: af585630231c3722f1002b665e9bee20
x-accel-expires: @1714613707
x-accel-date: 1713576978
x-cache: HIT
x-age: 517343
x-77-pop: stockholmSE
x-77-cache: HIT
x-77-age: 517343
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (18)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate