Report - fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html

Report Overview

Visited public
2023-12-02 12:14:20
Tags
microsoft phishing
URL
fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Finishing URL
fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
IP / ASN
162.62.150.176
#132203 Tencent Building, Kejizhongyi Avenue
Title
Signin Outlook WebApp Settings
Phishing - Microsoft

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
c.s-microsoft.com	10166	2012-02-07	2013-11-06 16:56:27	2023-12-01 13:22:22	1.3 kB	64 kB	23.38.201.156
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18 02:37:31	2023-12-02 05:09:23	1.2 kB	160 kB	104.18.11.207
stackpath.bootstrapcdn.com	2467	2012-05-25	2018-06-15 22:36:43	2023-12-02 05:17:37	1.2 kB	84 kB	104.18.10.207
fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com	unknown	2013-04-24	2022-06-02 22:34:36	2023-10-15 13:47:57	1.1 kB	30 kB	162.62.150.187
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2023-12-02 05:10:02	1.2 kB	15 kB	104.17.25.14
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-12-02 05:10:02	1.0 kB	56 kB	151.101.2.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-07	medium	fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html	Outlook

PhishTank

Scan Date	Severity	Indicator	Alert
2022-05-01	medium	fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	From	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.3.1.slim.min.js	ScriptElement	70 kB	2023-03-07	2025-05-11
Pretty URL code.jquery.com/jquery-3.3.1.slim.min.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 06:54 Times Seen5421 Hash 99b0a83cf1b0b1e2cb16041520e87641 bc5836992c0b260496ba520fe1336d499bf06eb7 dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1 Loading...

	cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js	ScriptElement	20 kB	2023-03-07	2025-05-11
Pretty URL cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 06:54 Times Seen3959 Hash 6b08ddc901000d51fa1f06a35518f302 bafe987c18cbe0587de3e6360e7da40a2885614b 02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5 Loading...

	fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html	ScriptElement	5.5 kB	2023-04-17	2024-08-21
Pretty URL fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html IP 162.62.150.187 ASN #132203 Tencent Building, Kejizhongyi Avenue Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-17 18:53 Last Seen2024-08-21 06:49 Times Seen4 Hash 711913e6eb4410d5a5ca1de4ac96da7c 2817193e9ae7501f8ae8b60d9b7210ca9eb0fc12 e497c5a55101f9eee691b20052f9a2b0d95ace06eedec868cff8bdb1ab7f1aa5 Loading...

	code.jquery.com/jquery-3.3.1.min.js	ScriptElement	87 kB	2023-03-07	2025-05-11
Pretty URL code.jquery.com/jquery-3.3.1.min.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 06:54 Times Seen57537 Hash a09e13ee94d51c524b7e2a728c7d4039 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Loading...

	stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js	ScriptElement	51 kB	2023-03-07	2025-05-11
Pretty URL stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js IP 104.18.10.207 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 06:54 Times Seen3841 Hash ce6e785579ae4cb555c9de311d1b9271 5ef2c15b47d7290698c737676ba9c3056b45f2e8 0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339 Loading...

	maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js	ScriptElement	37 kB	2023-03-07	2025-05-11
Pretty URL maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js IP 104.18.11.207 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 07:09 Times Seen27566 Hash 5869c96cc8f19086aee625d670d741f9 430a443d74830fe9be26efca431f448c1b3740f9 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Loading...

	unknown	Function	34 B	2023-04-11	2025-05-10
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:16 Last Seen2025-05-10 19:46 Times Seen67031 Hash 572cb94037fffc2a0a53b465972e15f1 0d679b041a7c1ca45cc99e2d229fc2b86762838d 6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35 Loading...

HTTP Transactions (12)

URL IP Response Size

fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html

162.62.150.187

200 OK

29 kB

URL User Request GET HTTP/1.1
fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
IP
162.62.150.187:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Certificate
IssuerGlobalSign nv-sa
Subject*.cos.eu-frankfurt.myqcloud.com
FingerprintC3:6C:C0:F6:49:39:82:9E:6C:DD:EB:8A:6F:02:7A:2F:A9:4B:0B:53
ValidityMon, 27 Feb 2023 06:46:03 GMT - Sat, 30 Mar 2024 06:46:02 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (7866), with CRLF line terminators
Size
29 kB (29277 bytes)
Hash
681f2b850f9912f45b7a9ef424fe6e04
4a3945e2b4d3db2aa4d9deb41b1d6bc8fc317c28
73e4beab5aa1cf867572003ccd1545f83852e111d4461dfb23e0257989eefd5e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft
OpenPhish	phishing	Outlook
PhishTank	phishing	Other

HTTP Headers

GET /edocs.html HTTP/1.1
Host: fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 29277
Connection: keep-alive
Accept-Ranges: bytes
Date: Sat, 02 Dec 2023 12:14:01 GMT
ETag: "681f2b850f9912f45b7a9ef424fe6e04"
Last-Modified: Wed, 23 Mar 2022 10:50:50 GMT
Server: tencent-cos
x-cos-hash-crc64ecma: 13448072247585116554
x-cos-request-id: NjU2YjFmODlfMTViNGYwMDlfMjI3ODlfNTQ5NTk1NQ==

cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js

104.17.25.14

200 OK

6.5 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (20322)
Size
6.5 kB (6458 bytes)
Hash
6b08ddc901000d51fa1f06a35518f302
bafe987c18cbe0587de3e6360e7da40a2885614b
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5

HTTP Headers

GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:02 GMT
content-type: application/javascript; charset=utf-8
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 198962
expires: Thu, 21 Nov 2024 12:14:02 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8p%2FwAjlTJinKqc93WmNfSlDIlKCmY3DbaFA4A10yM0mY8oUEedUAOdHFKk%2FRIb3ssG7cN42rYfcQwyEhWbG4vms2tnkBHqi%2FYHx46fIWzPBPQr7V2xZQe9Jj01VFhoQpeaDNMJr0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82f37cc29b491c02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.3.1.min.js

151.101.2.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.3.1.min.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65451)
Size
30 kB (30288 bytes)
Hash
a09e13ee94d51c524b7e2a728c7d4039
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

HTTP Headers

GET /jquery-3.3.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-1538f"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 02 Dec 2023 12:14:02 GMT
age: 6717042
x-served-by: cache-lga13622-LGA, cache-bma1677-BMA
x-cache: HIT, HIT
x-cache-hits: 24, 690169
x-timer: S1701519243.658045,VS0,VE0
vary: Accept-Encoding
content-length: 30288
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.3.1.slim.min.js

151.101.2.137

200 OK

24 kB

URL GET HTTP/2
code.jquery.com/jquery-3.3.1.slim.min.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65247)
Size
24 kB (24038 bytes)
Hash
99b0a83cf1b0b1e2cb16041520e87641
bc5836992c0b260496ba520fe1336d499bf06eb7
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

HTTP Headers

GET /jquery-3.3.1.slim.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-1111d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 02 Dec 2023 12:14:02 GMT
age: 6718642
x-served-by: cache-lga21982-LGA, cache-bma1635-BMA
x-cache: HIT, HIT
x-cache-hits: 140, 101162
x-timer: S1701519243.659777,VS0,VE0
vary: Accept-Encoding
content-length: 24038
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js

104.17.25.14

200 OK

6.5 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (20322)
Size
6.5 kB (6458 bytes)
Hash
6b08ddc901000d51fa1f06a35518f302
bafe987c18cbe0587de3e6360e7da40a2885614b
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5

HTTP Headers

GET /ajax/libs/popper.js/1.14.0/umd/popper.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:03 GMT
content-type: application/javascript; charset=utf-8
content-length: 6458
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03fa9-500f"
last-modified: Mon, 04 May 2020 16:15:37 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 198963
expires: Thu, 21 Nov 2024 12:14:03 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bDLkQFzNYwSf5Xev94kJD%2B3mir5mTWmfKtvR26gW6aJN9IDl251iICIzya65MbC%2FNPHuiOS7%2BCZu09POXQjXpjJeucV%2BAw4WEpKj%2BhSwiSkFDnjpeVYfFdyV9Y%2BXCFr8X%2F4HxhH5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82f37cc4dc501c02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2

23.38.201.156

200 OK

29 kB

URL GET HTTP/2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2
IP
23.38.201.156:443
ASN
#16625 AKAMAI-AS

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerMicrosoft Corporation
Subjectwww.microsoft.com
FingerprintE1:57:9B:A5:51:25:CE:C3:A7:8E:39:F5:5C:F8:1D:A8:BF:A9:4F:88
ValidityThu, 14 Sep 2023 17:24:20 GMT - Sun, 08 Sep 2024 17:24:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29388, version 0.0\012- data
Size
29 kB (29388 bytes)
Hash
6e75a94d5f7170a1ab532d32c2a35755
9c1b6fff544089941bbeddbcf529c3f0b46d853a
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

HTTP Headers

GET /static/fonts/segoe-ui/west-european/semibold/latest.woff2 HTTP/1.1
Host: c.s-microsoft.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 29388
content-type: font/woff2
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
accept-ranges: bytes
etag: "5b68d583e9c7d51:0"
cache-control: public, max-age=471423
expires: Thu, 07 Dec 2023 23:11:06 GMT
date: Sat, 02 Dec 2023 12:14:03 GMT
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2

23.38.201.156

200 OK

34 kB

URL GET HTTP/2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
IP
23.38.201.156:443
ASN
#16625 AKAMAI-AS

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerMicrosoft Corporation
Subjectwww.microsoft.com
FingerprintE1:57:9B:A5:51:25:CE:C3:A7:8E:39:F5:5C:F8:1D:A8:BF:A9:4F:88
ValidityThu, 14 Sep 2023 17:24:20 GMT - Sun, 08 Sep 2024 17:24:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 34052, version 0.0\012- data
Size
34 kB (34052 bytes)
Hash
36397a3bc139c6e9f81d383f060f080a
3f4f86c10920d4ed345f4858b6cde9f93e1aeb81
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

HTTP Headers

GET /static/fonts/segoe-ui/west-european/normal/latest.woff2 HTTP/1.1
Host: c.s-microsoft.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 34052
content-type: font/woff2
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
accept-ranges: bytes
etag: "588d483e9c7d51:0"
cache-control: public, max-age=184865
expires: Mon, 04 Dec 2023 15:35:08 GMT
date: Sat, 02 Dec 2023 12:14:03 GMT
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/favicon.ico

162.62.150.187

404 Not Found

433 B

URL GET HTTP/1.1
fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/favicon.ico
IP
162.62.150.187:443
ASN
#132203 Tencent Building, Kejizhongyi Avenue

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerGlobalSign nv-sa
Subject*.cos.eu-frankfurt.myqcloud.com
FingerprintC3:6C:C0:F6:49:39:82:9E:6C:DD:EB:8A:6F:02:7A:2F:A9:4B:0B:53
ValidityMon, 27 Feb 2023 06:46:03 GMT - Sat, 30 Mar 2024 06:46:02 GMT

File type
XML 1.0 document text\012- XML document, ASCII text
Size
433 B (433 bytes)
Hash
cb8bfcc5c487fc3375b3da0111895577
57d1358f025b3b37c88968fad8686ce4980dab59
ba76b0788833cd3e55346093fa57dd16d6c69286329b455155ade5806d74b365

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Content-Type: application/xml
Content-Length: 433
Connection: keep-alive
Date: Sat, 02 Dec 2023 12:14:03 GMT
Server: tencent-cos
x-cos-request-id: NjU2YjFmOGJfMTViNGYwMDlfMjI3YzRfNTQ1MTc0YQ==

maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js

104.18.11.207

200 OK

37 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT

File type
ASCII text, with very long lines (32033)
Size
37 kB (37045 bytes)
Hash
5869c96cc8f19086aee625d670d741f9
430a443d74830fe9be26efca431f448c1b3740f9
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

HTTP Headers

GET /bootstrap/3.3.7/js/bootstrap.min.js HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:02 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"5869c96cc8f19086aee625d670d741f9"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 10/31/2023 19:27:53
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1053
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 4f1cab238569909a7471949733e5bdfc
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82f37cc27e35568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js

104.18.10.207

200 OK

51 kB

URL GET HTTP/2
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
IP
104.18.10.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT

File type
ASCII text, with very long lines (50395)
Size
51 kB (50676 bytes)
Hash
ce6e785579ae4cb555c9de311d1b9271
5ef2c15b47d7290698c737676ba9c3056b45f2e8
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339

HTTP Headers

GET /bootstrap/4.1.0/js/bootstrap.min.js HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:02 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"ce6e785579ae4cb555c9de311d1b9271"
last-modified: Mon, 25 Jan 2021 22:04:05 GMT
cdn-cachedat: 08/05/2023 17:30:32
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1054
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 2e70df43ca616619ca0499528d0cf1f6
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82f37cc2589f5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

104.18.11.207

200 OK

121 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT

File type
ASCII text, with very long lines (65371)
Size
121 kB (121200 bytes)
Hash
ec3bb52a00e176a7181d454dffaea219
6527d8bf3e1e9368bab8c7b60f56bc01fa3afd68
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

HTTP Headers

GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:02 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"ec3bb52a00e176a7181d454dffaea219"
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-cachedat: 10/31/2023 18:59:36
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1078
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: e6b24972ec7724dc0925c2b54512d306
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82f37cc26e13568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

104.18.10.207

200 OK

31 kB

URL GET HTTP/2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.18.10.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/edocs.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint34:BC:91:5F:B9:EC:32:2C:D9:73:C7:88:C3:6C:FB:77:E7:70:8D:04
ValidityThu, 30 Nov 2023 00:15:17 GMT - Wed, 28 Feb 2024 00:15:16 GMT

File type
ASCII text, with very long lines (30837)
Size
31 kB (31000 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com
DNT: 1
Connection: keep-alive
Referer: https://fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 02 Dec 2023 12:14:02 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 18:48:06
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: c7044a88e1a66b7fa1ff2e54e757b841
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 82f37cc298c75688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (12)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP