Report - pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html

Report Overview

Submitted URL
pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
IP
104.18.3.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-03-29 16:00:10
Access
public
Website Title
Sign in to your account
Final URL
pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Tags
phishing microsoft outlook
urlquery detections
Phishing - Microsoft Outlook

Detections

urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
logincdn.msauth.net	2330	2018-10-25	2019-04-23	2024-03-28	520 B	2.2 kB	13.107.213.53
pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev	unknown	2022-08-23	2024-02-27	2024-02-27	508 B	307 kB	104.18.3.35
aadcdn.msftauth.net	1455	unknown	2018-11-19	2024-03-27	2.1 kB	72 kB	152.199.23.37
aadcdn.msauth.net	1421	2018-10-25	2018-11-19	2024-03-28	1.1 kB	2.5 kB	13.107.213.53
code.jquery.com	634	2005-12-10	2012-05-21	2024-03-28	437 B	31 kB	151.101.130.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-03-29	medium	pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html	Outlook

PhishTank

Scan Date	Severity	Indicator	Alert
2024-02-27	medium	pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html	Microsoft

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html	307 kB	2024-02-28	2024-04-17
Pretty URL pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html IP 104.18.3.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-02-28 00:04:49 Last Seen2024-04-17 18:10:27 Times Seen3 Hash 58edd0a39ea3cfb1bcd3e2219407b8d9 4a2354f7de5142f84873b8890c05b8465ada194c 23d70b390aecfd4a26f5977c883177aab0a985a4ee0896ddf9d81c84f8cacc17 Loading...

	code.jquery.com/jquery-3.1.1.min.js	87 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.1.1.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-29 04:42:07 Times Seen264359 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	unknown	11 B	2024-02-28	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-28 00:04:49 Last Seen2024-04-20 18:25:22 Times Seen11 Hash 1ce7db1c418ad718c6966b3979d1bdac bf9187fbfc491658be08e9b7d47de21111a5da6c 0f772892791f4d5db29e3bc7c4dabbb806887bb277826315289fdd0e7320aa65 Loading...

	unknown	4.1 kB	2024-02-28	2024-04-17
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-28 00:04:49 Last Seen2024-04-17 18:10:27 Times Seen3 Hash d14ccc7c131f39e09b2067e8f833eae4 b9c4d585cd2205ff2a0351904dc374eeddcc901a 8f3c279d1ae54183cf5a5d1843648d2c522ba54b8b74db4d666ca240c29b14db Loading...

	unknown	707 B	2024-02-28	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-28 00:04:49 Last Seen2024-04-20 18:25:22 Times Seen11 Hash bf03c5ae03e6fd36b83d45a4d41eb9c8 608e1d2e9af321295146deb20226d1152faad4ea 05ceeaea5f4793f239294b4b7cfeae3b4017062c2e3bb43b7969a1e98d0cdc87 Loading...

		Size	First Seen	Last Seen
	#1 Write - 17d9bfc17b0a1ee9d84f74667ce325aa	48 kB	2024-02-28	2024-04-17
Pretty Observations First Seen2024-02-28 00:04:49 Last Seen2024-04-17 18:10:27 Times Seen3 Hash 17d9bfc17b0a1ee9d84f74667ce325aa 0505bbaf1e42c870d6bc3d061f0f990459b8a49f 6191eed5db9ec18f533cf475dbd14067691ce6c5b6d4f57e81d3b3e9e09f66c8 Loading...

HTTP Transactions (9)

URL IP Response Size

pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html

104.18.3.35

200 OK

307 kB

URL User Request GET HTTP/1.1
pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
IP
104.18.3.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
FingerprintA2:61:33:D7:00:1D:E7:EF:C9:C3:35:ED:8F:FC:60:86:98:85:44:3A
ValidityTue, 06 Feb 2024 16:02:29 GMT - Mon, 06 May 2024 16:02:28 GMT

File type
HTML document, ASCII text, with very long lines (65423), with CRLF line terminators
Size
307 kB (307015 bytes)
Hash
f950f5604a0403c14f27431aa2bb3554
67d0fdf6ed3748fd4cc38f0df77c95cfc4edd6cf
f6c0b9624ab0459e6cda70fc60b4110c4e1be87d7be4c44579450355de97ee6e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Outlook
PhishTank	phishing	Microsoft

HTTP Headers

GET /haweu.html HTTP/1.1
Host: pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 29 Mar 2024 15:59:45 GMT
Content-Type: text/html
Content-Length: 307015
Connection: keep-alive
Accept-Ranges: bytes
ETag: "f950f5604a0403c14f27431aa2bb3554"
Last-Modified: Tue, 27 Feb 2024 05:12:15 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 86c111a1790fb51b-OSL

aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css

152.199.23.37

200 OK

20 kB

URL GET HTTP/2
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint3C:9E:70:F5:B3:D1:80:80:8C:97:1C:7B:7E:A8:2C:D8:7B:94:95:0B
ValidityFri, 01 Dec 2023 00:00:00 GMT - Sun, 01 Dec 2024 23:59:59 GMT

File type
ASCII text, with very long lines (61177)
Size
20 kB (19595 bytes)
Hash
440ca18024de46b4d73e7540a4fdde46
c4ff7af4e1558e081df52c1e61a5d63d0be577c7
ea6449d448a48495c557755af39701567925ceafc30e06fba05f65e723c91aa3

HTTP Headers

GET /ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 350555
cache-control: public, max-age=31536000
content-md5: +rPQJ6BWMovrMLNrlexvKQ==
content-type: text/css
date: Fri, 29 Mar 2024 15:59:45 GMT
etag: 0x8D88DD061D3546B
last-modified: Sat, 21 Nov 2020 03:49:00 GMT
server: ECAcc (ska/F686)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 4bd6eb98-a01e-0005-7fc1-7edd2c000000
x-ms-version: 2009-09-19
content-length: 19595
X-Firefox-Spdy: h2

aadcdn.msauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg

13.107.213.53

200 OK

276 B

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP
13.107.213.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
FingerprintEB:7C:D1:4E:EF:B5:D4:72:25:0B:1A:AF:5F:10:3D:EA:13:80:5A:47
ValidityMon, 29 Jan 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
276 B (276 bytes)
Hash
a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

HTTP Headers

GET /ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 29 Mar 2024 15:59:45 GMT
content-type: image/svg+xml
content-length: 276
cache-control: public, max-age=604800
content-encoding: gzip
last-modified: Fri, 02 Nov 2018 20:25:09 GMT
etag: 0x8D64101494758DF
x-ms-request-id: 79b36b0d-401e-0062-4baf-81f1b8000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240329T155945Z-ue5r8hkykx1m1a4mudt9chtxg00000000asg000000001ruq
x-fd-int-roxy-purgeid: 4554691
x-cache-info: L1_T2
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.130.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 29 Mar 2024 15:59:45 GMT
age: 16927385
x-served-by: cache-lga21947-LGA, cache-hel1410022-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 20226
x-timer: S1711727985.396230,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg

13.107.213.53

200 OK

1.4 kB

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
IP
13.107.213.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint15:1B:3E:26:F4:4A:EE:1C:C2:40:74:BB:BD:AE:20:E4:35:B0:40:40
ValidityWed, 17 Jan 2024 06:03:21 GMT - Sat, 11 Jan 2025 06:03:21 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1435 bytes)
Hash
ee5c8d9fb6248c938fd0dc19370e90bd
d01a22720918b781338b5bbf9202b241a5f99ee4
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

HTTP Headers

GET /shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 29 Mar 2024 15:59:45 GMT
content-type: image/svg+xml
content-length: 1435
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 22 Jan 2020 00:38:07 GMT
etag: 0x8D79ED359808AB6
x-ms-request-id: 69bba1b8-101e-0007-1e4f-7b3490000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240329T155945Z-srwvnc5u0h5s146ty3uzpy766000000007s0000000009nac
x-fd-int-roxy-purgeid: 67501246
x-cache-info: L1_T2
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg

13.107.213.53

200 OK

673 B

URL GET HTTP/2
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
IP
13.107.213.53:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
FingerprintEB:7C:D1:4E:EF:B5:D4:72:25:0B:1A:AF:5F:10:3D:EA:13:80:5A:47
ValidityMon, 29 Jan 2024 00:00:00 GMT - Wed, 29 Jan 2025 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
673 B (673 bytes)
Hash
bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

HTTP Headers

GET /shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 29 Mar 2024 15:59:45 GMT
content-type: image/svg+xml
content-length: 673
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 22:01:30 GMT
etag: 0x8D7B0071D86E386
x-ms-request-id: 24cdda0b-401e-0026-6aae-7a8ea1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20240329T155945Z-ue5r8hkykx1m1a4mudt9chtxg00000000asg000000001rur
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css

152.199.23.37

200 OK

20 kB

URL GET HTTP/2
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint3C:9E:70:F5:B3:D1:80:80:8C:97:1C:7B:7E:A8:2C:D8:7B:94:95:0B
ValidityFri, 01 Dec 2023 00:00:00 GMT - Sun, 01 Dec 2024 23:59:59 GMT

File type
ASCII text, with very long lines (61177)
Size
20 kB (19595 bytes)
Hash
440ca18024de46b4d73e7540a4fdde46
c4ff7af4e1558e081df52c1e61a5d63d0be577c7
ea6449d448a48495c557755af39701567925ceafc30e06fba05f65e723c91aa3

HTTP Headers

GET /ests/2.1/content/cdnbundles/converged.v2.login.min_rayhgcterrtxpnvapp3erg2.css HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 350555
cache-control: public, max-age=31536000
content-md5: +rPQJ6BWMovrMLNrlexvKQ==
content-type: text/css
date: Fri, 29 Mar 2024 15:59:45 GMT
etag: 0x8D88DD061D3546B
last-modified: Sat, 21 Nov 2020 03:49:00 GMT
server: ECAcc (ska/F686)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 4bd6eb98-a01e-0005-7fc1-7edd2c000000
x-ms-version: 2009-09-19
content-length: 19595
X-Firefox-Spdy: h2

aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js

152.199.23.37

200 OK

12 kB

URL GET HTTP/2
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint3C:9E:70:F5:B3:D1:80:80:8C:97:1C:7B:7E:A8:2C:D8:7B:94:95:0B
ValidityFri, 01 Dec 2023 00:00:00 GMT - Sun, 01 Dec 2024 23:59:59 GMT

File type
Unicode text, UTF-8 text, with very long lines (32020)
Size
12 kB (12109 bytes)
Hash
b193abd9426d48dfc1fa22b46fbe381c
c18385663a0f7e7325a19dbe51ea9d98c0dba81f
0d09dd2364d30f75223cba28506b02e431f911bad2ad2ce11a81a6cee08dfd26

HTTP Headers

GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_szor2ujtsn_b-ik0b744ha2.js HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 340571
cache-control: public, max-age=31536000
content-md5: 6Qvaph3XjGlz0gTgNQb8QQ==
content-type: application/x-javascript
date: Fri, 29 Mar 2024 15:59:45 GMT
etag: 0x8D8B274B724F769
last-modified: Wed, 06 Jan 2021 18:56:03 GMT
server: ECAcc (ska/F772)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 987a7abd-201e-0059-25d9-7e4a06000000
x-ms-version: 2009-09-19
content-length: 12109
X-Firefox-Spdy: h2

aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico

152.199.23.37

200 OK

17 kB

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/haweu.html
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint3C:9E:70:F5:B3:D1:80:80:8C:97:1C:7B:7E:A8:2C:D8:7B:94:95:0B
ValidityFri, 01 Dec 2023 00:00:00 GMT - Sun, 01 Dec 2024 23:59:59 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

HTTP Headers

GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-6f0d07ee3a0e4376a613b38a5c61476a.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 394763
cache-control: public, max-age=31536000
content-md5: EuPayFgGHQiAI7K9SOL6lg==
content-type: image/x-icon
date: Fri, 29 Mar 2024 15:59:45 GMT
etag: 0x8D8731240E548EB
last-modified: Sun, 18 Oct 2020 03:02:30 GMT
server: ECAcc (ska/F738)
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 582df77a-301e-0028-1b5a-7e9304000000
x-ms-version: 2009-09-19
content-length: 17174
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (9)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size