Report - sailingworldonline.com/cgi/css/tAu7MxHqp/bWljaGFlbC5mcmFzZXJAbnR0LXJlc2VhcmNoLmNvbQ==

Report Overview

Visited public
2024-03-18 19:22:18
Tags
microsoft phishing outlook
URL
sailingworldonline.com/cgi/css/tAu7MxHqp/bWljaGFlbC5mcmFzZXJAbnR0LXJlc2VhcmNoLmNvbQ==
Finishing URL
scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
IP / ASN
192.185.101.199
#19871 NETWORK-SOLUTIONS-HOSTING
Title
db5fdee90aa9e3edca9b9ebce39e478c65f89456a66e2
Phishing - Microsoft
Phishing - Microsoft Outlook

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
sailingworldonline.com	unknown	2015-09-29	2019-06-12 18:05:47	2024-01-20 16:19:00	539 B	221 B	192.185.101.199
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20 07:02:03	2024-03-17 21:03:03	1.9 kB	196 kB	104.17.2.184
scarletfiles.com	unknown	2024-03-07	2024-03-07 06:01:18	2024-03-07 18:36:06	13 kB	943 kB	104.21.79.46
unpkg.com	11693	2016-01-06	2016-01-08 00:26:01	2024-03-18 00:36:01	826 B	84 kB	104.16.125.175

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (31)

	URL	From	Size	First Seen	Last Seen
	scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930	ScriptElement	0 B	0001-01-01	2025-05-30
Pretty URL scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930 IP 104.21.79.46 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-05-30 23:49 Times Seen4799725 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	Function	79 B	2023-04-11	2025-05-30
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:38 Last Seen2025-05-30 23:44 Times Seen113592 Hash aa049e2749b8531cb8f233c2f64fc2b2 b611a5a62c1813ae5b4763378b3a4a565556530a e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2 Loading...

	scarletfiles.com/boot/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a30	ScriptElement	51 kB	2023-03-07	2025-05-30
Pretty URL scarletfiles.com/boot/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a30 IP 104.21.79.46 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-30 23:44 Times Seen100210 Hash 67176c242e1bdc20603c878dee836df3 27a71b00383d61ef3c489326b3564d698fc1227c 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Loading...

	scarletfiles.com/jm/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a32	ScriptElement	6.4 kB	2023-10-11	2024-08-21
Pretty URL scarletfiles.com/jm/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a32 IP 104.21.79.46 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-11 19:03 Last Seen2024-08-21 05:00 Times Seen40711 Hash 82ff6e77e3b8f004b23294185e108264 03c685b50fd4587427495348cd1231882a8c48d0 0e230a53a5d5abd125c2a8e1cdd97b32ddd84a9f7fd07c23bff95413886b05fa Loading...

	unpkg.com/axios/dist/axios.min.js	ScriptElement	42 kB	2024-03-15	2025-05-30
Pretty URL unpkg.com/axios/dist/axios.min.js IP 104.16.125.175 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-15 17:36 Last Seen2025-05-30 23:37 Times Seen6042 Hash 3b5b3d36fde8ffe8ed76b1efbfc65410 d63107d0912fdb387530d5ce2d512c928d73d122 29d600462a30694efd15b9848b4ca42d178cd067009275c35a30580121114304 Loading...

	unknown	Function	37 B	2023-04-11	2025-05-30
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:31 Last Seen2025-05-30 23:44 Times Seen267737 Hash 29d0c84b9d1d8da446a6062c6a840ad9 6d6b3a6065667c7c50d92f3889c85ed65a9ad784 3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1 Loading...

	scarletfiles.com/jq/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a2b	ScriptElement	86 kB	2023-03-07	2025-05-30
Pretty URL scarletfiles.com/jq/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a2b IP 104.21.79.46 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-30 23:44 Times Seen176641 Hash 2f6b11a7e914718e0290410e85366fe9 69bb69e25ca7d5ef0935317584e6153f3fd9a88c 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Loading...

		Size	First Seen	Last Seen
	#1 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07 01:03	2025-05-30 23:49
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-30 23:49 Times Seen373258 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#2 Eval - 679c40836f8915d367092e21eff968d5	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 679c40836f8915d367092e21eff968d5 3342b5de7ea81e09c81059e0d22dd0e04eb963d3 7b22deb3abdf7f635bdaa9fd6ad04df02af520a5f142f0bee6061cea896538e5 Loading...

	#3 Eval - f51e6adb0d33a68ce87f8ad33d5f1dcf	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash f51e6adb0d33a68ce87f8ad33d5f1dcf abb8b4f6e79094ce4d9ef2960377660a675df196 449abe08b3957e11026cefcf2a7cc9068dfb042fbe480db41b55c8d6822ca32a Loading...

	#4 Eval - 29ee33dc287b50a699f9bdf6ee40a155	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 29ee33dc287b50a699f9bdf6ee40a155 f47b42b5e36af0398ad129db509a572049ccd115 cb84a4742234ee7b8da3a37ca583bf75ec31a7622c97844575d1d7ff5fc95837 Loading...

	#5 Eval - 36a8bf5de45e91d968ded4a0f89b01ce	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 36a8bf5de45e91d968ded4a0f89b01ce 27d42dc689b184614cfa2166b2537bc4a0476abb 8131e89d8d19adcc9b86c0bf7b1283823c27c3f2381defd9c71eeafa27d78cb0 Loading...

	#6 Eval - b4e5ac459315caa07e96b3988ae91504	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash b4e5ac459315caa07e96b3988ae91504 719219dfe33eb899818257cb3094c1739609454e 0bd78f60bb166fe6217e10192df566a6d571938cc3e7488944701edbd2418466 Loading...

	#7 Eval - 6c6b03563d09eccca7a135f6d622d3cf	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 6c6b03563d09eccca7a135f6d622d3cf 1ed25d207c40484242e5456f230b0024fdd2e98f d160fcabc73de6ed4cafc61bca610fd3772e07f71d07b7d850310e53345a9eb9 Loading...

	#8 Eval - 143533fa81d599dcc832677055951c1e	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 143533fa81d599dcc832677055951c1e b103ede9830d0d2b10e9a243b3518b51d17e9079 0d4cf160e6111fae80a0ef52a7e89c88f7bb6f34b7de5cbc1dca88e8a9dcfa76 Loading...

	#9 Eval - 44c1a4be848803269c601bb2aa60671f	1.1 kB	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 44c1a4be848803269c601bb2aa60671f e591e3345f4322ce0206ac4b6282b2235cd9e6ea ccc8ba4eedd0e5896b6326f879229989ebc0f6d7b7f0884beb29da0bfeead5dd Loading...

	#10 Eval - 039341a2f93fe3de5ce5f96a8240616a	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 039341a2f93fe3de5ce5f96a8240616a 700fcd1049c0c2744dd72c885cfde5686e5e1797 130b4531d24fab615baddd11b0bb08b13d4d25c929230f3be8e11fadadc5bc47 Loading...

	#11 Eval - 6b2eacc562ef20d3ad9b08365edef124	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 6b2eacc562ef20d3ad9b08365edef124 3baab3b1d2bbf8d8f03eb616c16f94e1ed0fedbb 174bbf57865041e235a7d6edc054fc8f08f744a36e239b1d22dd052281d84274 Loading...

	#12 Eval - 36f1b5b8b7f85198df1403ee40a80dcd	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 36f1b5b8b7f85198df1403ee40a80dcd 08c4582cc806c65b80f9b7720090373a798e1311 334a3d6e6ca66246fafb0278daeed39d0dd5c5b470f47bb9e31952c8d726b457 Loading...

	#13 Eval - 059e16d6ae877a94ccca1c2238fc633f	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 059e16d6ae877a94ccca1c2238fc633f d6fd42983f86e5117e4b09cfa48511eb1e045e4e e6b206c9a931b36de77e06d35b1e3b10e6a3f749f0949ea0264a0e9fb390ea8a Loading...

	#14 Eval - 71d7809a9f3e4d3fb33ef686403f8f3e	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 71d7809a9f3e4d3fb33ef686403f8f3e 0578424554150a8f935e5847746db86b26ccfd69 376a41bafc630cdf6c72cda92e480b25ce4fe3233f2460611cca1ff4cf9ab7c4 Loading...

	#15 Eval - 94ca81f6d5e6105db29a72a165e67560	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 94ca81f6d5e6105db29a72a165e67560 d4ebaf0d660964272c072f0c408382538595c834 e558beb2ca86f6c8ebc41efc4334f669fb5fb040ed2d3dad14e1be3994cd1b4e Loading...

	#16 Eval - 93ae7adbf4a1639bd48a66574e17c0ea	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 93ae7adbf4a1639bd48a66574e17c0ea e7a4cdb49e303fd8b3d81023531a57830fc870d5 6b68e645aee1af0ff78f37ecca950f885d2623c39ccc622e48ac8386ad4ffb2b Loading...

	#17 Eval - d767fe53e104c30df43f7adf9e8da90a	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash d767fe53e104c30df43f7adf9e8da90a a1032a9f981c554b217b661dec6d0d1733a008ad 43d96ece43ddcf2dfd9b4d1fc4f779e712be9fab94331f2e63d2f1fefaecdcdd Loading...

	#18 Eval - e45fa3e72a6270fa4de85f3ba2909292	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash e45fa3e72a6270fa4de85f3ba2909292 40725e7a1f3b01a7ce45e9daa223b4c72e1f2e03 ce88a717e491ae40da8c93c37358364bebe0b660c6d43c565144f0263d90c4e0 Loading...

	#19 Eval - ffcd90494c4b5d1f84c27266e80be9c5	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash ffcd90494c4b5d1f84c27266e80be9c5 10fd4580e787c766461e97f0337c8df5333503ba 8c6c34410dba38f37be58c87c89da960e9359c397cb80162b6fe59c5dac854b4 Loading...

	#20 Eval - c1f49acc31addf87cda40c432c8c99fb	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash c1f49acc31addf87cda40c432c8c99fb a72f6af3ad62ed669404c1cd91721670bc84af06 3ab2b41686c6a6f1c3ff37ef75f9d5d0d8ee771f6f52ed1435a3f653616932d9 Loading...

	#21 Eval - 139264eb28355921dee7abe881ee4dd0	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 139264eb28355921dee7abe881ee4dd0 1c5a527cba77424abc60b71eb6614b5974edda46 9b636b63cb6c47f0c7766915c72cd7823839705d485cbc0d06a7af7e80fc9ad1 Loading...

	#22 Eval - 57a70c5124c5ab2b32aaa19aaf94364d	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash 57a70c5124c5ab2b32aaa19aaf94364d 7f74a71c21163aabb21f40b4f4115cdbe4a6c55c 6348f5c5d94370b6bfd7c37782694347f813e59d5741362797246435b70ba0d1 Loading...

	#23 Eval - e4ab2bf094ed21baf31b30b74ca37b6a	28 B	2024-08-20 07:41	2024-08-20 07:41
Pretty Observations First Seen2024-08-20 07:41 Last Seen2024-08-20 07:41 Times Seen1 Hash e4ab2bf094ed21baf31b30b74ca37b6a b79be95e0d820977e1eadcfd957c8bbf3dc584fd 8a44fb4bb47ba4b29bf3f963c4be87b3f9d78010464953aa01fe784237b180a9 Loading...

		Size	First Seen	Last Seen
	#1 Write - 814e95c3385fa198c504c4cb248de397	3.6 kB	2024-03-18 12:46	2024-08-20 07:43
Pretty Observations First Seen2024-03-18 12:46 Last Seen2024-08-20 07:43 Times Seen2264 Hash 814e95c3385fa198c504c4cb248de397 3ddadac95bd8eb1ec9237cb866109073385d9b3a 19e9481248eb8a927ebd944443885ec79e95fd4b24c7ab3b4bd86caa9e9510eb Loading...

HTTP Transactions (23)

URL IP Response Size

sailingworldonline.com/cgi/css/tAu7MxHqp/bWljaGFlbC5mcmFzZXJAbnR0LXJlc2VhcmNoLmNvbQ==

192.185.101.199

200 OK

0 B

URL User Request GET HTTP/2
sailingworldonline.com/cgi/css/tAu7MxHqp/bWljaGFlbC5mcmFzZXJAbnR0LXJlc2VhcmNoLmNvbQ==
IP
192.185.101.199:443
ASN
#19871 NETWORK-SOLUTIONS-HOSTING

Certificate
IssuerLet's Encrypt
Subject*.sailingworldonline.com
FingerprintA6:98:CC:9A:9F:2A:58:98:CD:C0:74:0D:E0:FD:81:CC:DE:34:33:96
ValiditySat, 20 Jan 2024 14:17:40 GMT - Fri, 19 Apr 2024 14:17:39 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cgi/css/tAu7MxHqp/bWljaGFlbC5mcmFzZXJAbnR0LXJlc2VhcmNoLmNvbQ== HTTP/1.1
Host: sailingworldonline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
refresh: 0;url=https://scarletfiles.com/Mmichael.fraser@ntt-research.com
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 18 Mar 2024 19:21:51 GMT
server: Apache
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/g/956dacbeead0/api.js?onload=LCxP0&render=explicit

104.17.2.184

29 kB

URL
challenges.cloudflare.com/turnstile/v0/g/956dacbeead0/api.js?onload=LCxP0&render=explicit
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (39814)
Size
29 kB (28864 bytes)
Hash
a5c4c24d608f5ec6f1e2e50d2181b5a1
d7e323ca6ec502109cd6b6d75c2fdf871870ae09
d7bed0ec1b182c64e160f602e4e60abbb43c89db99a03d89561da6dd39073515

HTTP Headers

GET /turnstile/v0/g/956dacbeead0/api.js?onload=LCxP0&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://scarletfiles.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 18 Mar 2024 19:21:52 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 86679695efec56c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=866796970b36b4f3

104.17.2.184

152 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=866796970b36b4f3
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
152 kB (152483 bytes)
Hash
7a363ef1675ffb18d3f04b876364ae91
9772eaf3ea22fb674325887bc84b9a504e1c86fe
d0dd7f10fd817fe614fdb53ac20e13e9c63fed284700c9f25463966acce23226

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=866796970b36b4f3 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iycyg/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:52 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server: cloudflare
cf-ray: 86679697dc63b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/Mmichael.fraser@ntt-research.com

104.21.79.46

302 Found

7.5 kB

URL User Request POST HTTP/3
scarletfiles.com/Mmichael.fraser@ntt-research.com
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
HTML document, ASCII text, with very long lines (16013), with no line terminators
Size
7.5 kB (7517 bytes)
Hash
b1058bc935d07e51a04a3ea98d1ba8e8
35cd554653403409a2c3c9875199fcfe42caed11
a053e99364f46bf76410b471be387367bd00745035dcd2be2aeaa33db8332dc8

HTTP Headers

GET /Mmichael.fraser@ntt-research.com HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Mon, 18 Mar 2024 19:21:52 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: MlmRvuSVocUWHe4m8uvKXHDi0C2nDGC+Cg6Jk4h9PYV/ssLhVLlx9eAn9Birw0ngnjlbsrrYNiay2S2fhV3owRaLWIAr9PVIT1QhWQR/7BmFeT5jJ0HlK800KO2PssWbDUKVoZPHPugBbokW9KRS+Q==$qHrCJR1IbQra78i4f/49/A==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BkKaZWhxl8XbWoiCfqc1PfCLtavfaO9kAioUaJJ4sbzNGHv6oEmgGggUT0G3GLT9GeGi%2BAD5JX8lLjAMpbIwyOFdqSxqci4%2B9DQWDKaKSJ2xIBGsHR5WEAOGxi9tce2T4OsE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86679694483a0b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

scarletfiles.com/boot/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a30

104.21.79.46

200 OK

24 kB

URL GET HTTP/3
scarletfiles.com/boot/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a30
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
JavaScript source, ASCII text, with very long lines (50758)
Size
24 kB (24034 bytes)
Hash
67176c242e1bdc20603c878dee836df3
27a71b00383d61ef3c489326b3564d698fc1227c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /boot/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a30 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/javascript
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPdJl8RUJuO7hEDtPDc4jzxQEKATqJ3HhPIemzePxKSKs3pBwOX3skLNdF5mynr2wcfyVt%2F%2BfagFVvRVZ7IOXpVlctub%2FUzuFslzJC0QyfFy%2F7ScRShKUjCfpP%2BwNDM%2BNEE0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796bf083fb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1988412376:1710785393:HlA8RdCcIJB_ADHFJ0g06rdF28A7tXUObft9319PaRQ/86679694483a0b02/ed126004f0e5b80

104.21.79.46

317 kB

URL
scarletfiles.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1988412376:1710785393:HlA8RdCcIJB_ADHFJ0g06rdF28A7tXUObft9319PaRQ/86679694483a0b02/ed126004f0e5b80
IP
104.21.79.46:0
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
ASCII text, with very long lines (3548), with no line terminators
Size
317 kB (317168 bytes)
Hash
6f9e1dc4f5f3b3fc1739c8b70098dc67
61a64ea48f0ae070ad24151e176bdada50c2b788
a2b3e038dd2738ae44802cdc6d34e7fa6e33dcf3dccf010c839c68564f827412

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1988412376:1710785393:HlA8RdCcIJB_ADHFJ0g06rdF28A7tXUObft9319PaRQ/86679694483a0b02/ed126004f0e5b80 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://scarletfiles.com/Mmichael.fraser@ntt-research.com
Content-type: application/x-www-form-urlencoded
CF-Challenge: ed126004f0e5b80
Content-Length: 3319
Origin: https://scarletfiles.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/html; charset=UTF-8
set-cookie: cf_chl_rc_m=;Expires=Sun, 17 Mar 2024 19:21:58 GMT;SameSite=Strict
cf-chl-out: 2Vu/2ZwzeY9mok+fKNkig8d41EfC6NnpojuuL6sMJh4M+U0UwOlXXbyri4qEBWwaJTlz8QvNHfjrJXof9JZuog==$THSWZ+8xnitaHvg6n3xacQ==
cf-chl-out-s: h/d1ueGpy2v4Qnq6lUiXk5+0mSj50y/xRX4vkA6ScEexGWusSBy2AwbYAaDOpDY89muZxiwul8vmTzrsqMUkUaS8WRs1Kgit1gSIkB7SCOdqINtLh+pwJAVt6Jlc6S+n4mXto3bC5RPFQ4O1etlGL0bYo9qCIsX/I7iUNLutdgQ4WJeq4Crcw212BUpvRUuqWm7nPxO6q2oP0oIUOCe96jUcVaodyLAg4LcXoIrEVhbhGH82lOV4KjoqC9YTOvIqHU/9Wv3gC4RXxw3uLklbiQ+SdYiIAmTYZdC2M3WsbJLoT1WPP+d8sj0QABz5QWdXCsEt5NKGjztKdiW3JxyNNQckv5sR75LdNqH25UamyUhkbnjdFmzF+APP1+OJCCcxVwC1AlGyp38tSlIeLM8WIKNcsuhDnzndbXModvhqwL2I8SJ2Vh0B2gMNVW6hFTX7H8HYACjcAe3HaHa5ayPBhw==$y2E6QdQrNjFpnkz3/mNYzw==
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HrKvalByMAAqDcM2ebPYMi7Y7No8BWU%2FHrSuwq8aYOnP0fOSf7MIUBbXJLIi6rKFSp2C7GI9qCnGhfO%2FiUrGbPXki22zrCEp6cZnmAYKf5dm4C%2B0DlzDEMfjTXep%2FMaZ1Uql"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796ba7880b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/Mmichael.fraser@ntt-research.com

104.21.79.46

302 Found

11 kB

URL User Request POST HTTP/3
scarletfiles.com/Mmichael.fraser@ntt-research.com
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
data
Size
11 kB (10667 bytes)
Hash
c759375ed21620b19324a10db5382845
79c242b313f0af8864f9efb2652b6666a892c251
082a8eada2a21096c21838626ff0fe2613f56e6da5a2eca2aebe8175f219f126

HTTP Headers

POST /Mmichael.fraser@ntt-research.com HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://scarletfiles.com/Mmichael.fraser@ntt-research.com?__cf_chl_tk=IEzFrEFUYEjE.3CZ7QLTfWxUqbx8wvJOfhAlItLP3w0-1710789712-0.0.1.1-1642
Content-Type: application/x-www-form-urlencoded
Content-Length: 4369
Origin: https://scarletfiles.com
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 302 Found
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/html; charset=UTF-8
location: ./beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; path=/; expires=Tue, 18-Mar-25 19:21:58 GMT; domain=.scarletfiles.com; HttpOnly; Secure; SameSite=None
PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWSWhSghUTj%2B8GCCCyvS9WESqCHakTgAqlgAKqsXMjOZFaDAM38QExvQNVjrL7nponJuaDEO72LK04P6AcSUQ6YpkBQVfD0yG4NOat34LcOpOtfFuJ7SFfaw4VZxRNpuRvuj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796bb69f6b50b-OSL
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/261310335:1710785807:L8dGUuKnOiQPPXol17PxPgSwP3wEyQEsabuwPmcK_gE/866796970b36b4f3/5947157679f9e7e

104.17.2.184

13 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/261310335:1710785807:L8dGUuKnOiQPPXol17PxPgSwP3wEyQEsabuwPmcK_gE/866796970b36b4f3/5947157679f9e7e
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (3496), with no line terminators
Size
13 kB (13398 bytes)
Hash
ff7bf52fcca3ed65a2a487f4f8e3c3d9
66c38f8bd098cceba446bc40a04eb25a3a30e895
930f4a10e57af5ff4153ad12a62d8a2061ce32f9a150bed540fed5fc4e108eff

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/flow/ov1/261310335:1710785807:L8dGUuKnOiQPPXol17PxPgSwP3wEyQEsabuwPmcK_gE/866796970b36b4f3/5947157679f9e7e HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iycyg/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 5947157679f9e7e
Content-Length: 26998
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: FmHoAdxffIhlTDUv88e/3lC5+VeR4GYByuqapkfGTzFVC7bZkK/I89DHaxMoEiyqfhsaA+9nupImPJOyq/XxF8nYbL1Y41MoprwKPTXm42cK6g/pkSmsrvF1mrbC6OWP$oIHZaWTpYiuHjVCon64ORA==
cf-chl-out-s: R4+sFMUlkE866QOOq5GWJS9Ftjj+1jsgIkNn2dvllo4aBHoan05sgDyz1tvIfH/5Fm7u9ZrXx2AOyp66zwi2N3y4v667KJr9RFCJE09FZ32G7bj2wmt2jArq04nPsvTinVeupxDxpQD3ODwEv4YA9X/cNeJ4qosgRBjtmDTgORHW7lJpG5ameu+BTpDIgHQu4mHBC33GTbXNsl1uifj8ivzabkcIcxcnUL+EFidKsUg+N9bJEprRfx6I17YKDhWezMZlGe3PtQS0zC+c+DWQaDKadQW+fg620y8vDC5KxCf4Ejd0W7RchiS5etLXZyXnCizvkR5V0SiS3eo16Iiunwppqu4ASSsIug6BQw46lqql74eyVyQXU1QVSUG4wu5fWAOJwAjhS+pJygoPV7V26TjfG0nwAKtSqU3Sczt4o05EUHf8EOS7D7ZNYPmiEAYPFom8LBPVYTXgfluUyfebTbTX5y01oyaDVqozowN7AzRvW9cuQluRc2PRl55nN52caeyR2Njr8o00rP8uRyv7SM2AoLFoj76JKpBTjHqPfmjoxjQI58DqpETXQanj7ox+CJ8BYS3C8m+HsNlEE5a/v2rk+WujNTeJ31d/IrAVjKsHSLn7oP929xa8Asw/6f8y$0a0oAzh3eCtds7gvDL9zGQ==
server: cloudflare
cf-ray: 866796b9da83b4f3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/APP-KLBL9L/08423d28248f4509907ebb0c9bb0cb0a65f894572d78d

104.21.79.46

200 OK

105 kB

URL GET HTTP/3
scarletfiles.com/APP-KLBL9L/08423d28248f4509907ebb0c9bb0cb0a65f894572d78d
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
105 kB (105369 bytes)
Hash
8e6b0f88563f9c33f78bce65cf287df7
ef7765cd2a7d64ed27dd7344702597aff6f8c397
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /APP-KLBL9L/08423d28248f4509907ebb0c9bb0cb0a65f894572d78d HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/css
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t1%2B%2FYd4RSjPbUnE%2FiwNs0jzZHpf%2BldH5FwRmikbHfzs6TU9x6ZlZm3UdxvrYch%2FntQQrcKkEin1q0txlRRqlfqEu0%2Bw6JO25HoqaqLE06QVSfbShK2gw0UuHIHMd6s9zs2ET"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c1bc61b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/o/08423d28248f4509907ebb0c9bb0cb0a65f894572d933

104.21.79.46

200 OK

3.7 kB

URL GET HTTP/3
scarletfiles.com/o/08423d28248f4509907ebb0c9bb0cb0a65f894572d933
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
SVG Scalable Vector Graphics image
Size
3.7 kB (3651 bytes)
Hash
d633a913e6f3b1f45774b9874dfc85e0
5ba1344048578062c93cfddfdf8458477eaca476
c1fbfbd9a81fc4d9c9539a65bdfb4c6738926b8d4681b0346706196413e92714

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /o/08423d28248f4509907ebb0c9bb0cb0a65f894572d933 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dr6JBKbkWtvry2%2B6HU6PMxrM%2FFObuboiK5f8z4r5DBAIPbITy7CkQyRDPkZMCPfecF9ukt2CQAzASLq%2FDwP5kiwXA1GGsX5HBl%2B8WbAVraCoJM%2FbDSvGnvA5Z%2ByNA%2BEzRrNu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c1ac4cb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/e/08423d28248f4509907ebb0c9bb0cb0a65f894572d93a

104.21.79.46

200 OK

513 B

URL GET HTTP/3
scarletfiles.com/e/08423d28248f4509907ebb0c9bb0cb0a65f894572d93a
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
SVG Scalable Vector Graphics image
Size
513 B (513 bytes)
Hash
adc405f5fd089662209870ca5d2106f7
3a8b776df84bf251afc6ddd802cc5bbeddfb0e36
e7bacc97751689afaae192e103fe9851664365c57c7d783560860ad456db7e49

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /e/08423d28248f4509907ebb0c9bb0cb0a65f894572d93a HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: image/svg+xml
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6qUjIYHtkC3VZlrRN4RSHOsf1y3csmG1ycxL8WFFO9VnRqfkx%2BrbRuTC0zsbXCyXsvE%2FM5yHqHraT0I8ko243j%2BOqgH04Ex90E7ZbMF0fWWAb0SLhS1%2FYkD0h7BwHWalKO47"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c1ac4eb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/api-as1f?email=michael.fraser@ntt-research.com&data=background

104.21.79.46

200 OK

91 B

URL GET HTTP/3
scarletfiles.com/api-as1f?email=michael.fraser@ntt-research.com&data=background
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
91 B (91 bytes)
Hash
f5f413130d06b4cb609db4b98627ab6f
22777cc4265aeb747b3836e31b1c76e259c839aa
5691f07ef72f2b6155138a14b045e8bdc61e7bb556833df0479247cb1e2fcbfc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /api-as1f?email=michael.fraser@ntt-research.com&data=background HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jw4f%2B5v%2F82HnZRtFda9KQ1l1JonWl7Gd1ThB4NIZDL%2BnNQ1L8%2F2VrPP%2FngeacG95B%2BsUPjRpTgYvp8uHKjTV9UNwM20ZDLUtkC6mviCPDFrhKAtACPAqkT5ChsG6OuIhyhAh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c1bc57b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/ASSETS/img/LIMG-65f894584c42f.css

104.21.79.46

200 OK

1.6 kB

URL GET HTTP/3
scarletfiles.com/ASSETS/img/LIMG-65f894584c42f.css
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
PNG image data, 108 x 24, 8-bit colormap, non-interlaced
Size
1.6 kB (1637 bytes)
Hash
ee236805d05e24861ce1b6b0e7d94b8d
d46828cf9df268ddaf62facf15590a447116aeb8
175986272200fb72da9a598d30016bbda9ddcaa9e6e3f07eb94bc74196d4b805

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ASSETS/img/LIMG-65f894584c42f.css HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:22:00 GMT
content-type: image/png
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyOk7deRcOvPO9CsmnepvW0ThMBOj3YCfwpqfWWcCPjEiEVZZW4V%2FCWu%2FX3RvdlCrArF4Nmmv6umBKoN6q0j%2BHw4E2oQ1urXUkfjif4fYGrmJwqY%2FKGMAlnfpeAj11RETu%2Fk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c83e49b50b-OSL
alt-svc: h3=":443"; ma=86400

unpkg.com/axios/dist/axios.min.js

104.16.125.175

302 Found

42 kB

URL GET HTTP/2
unpkg.com/axios/dist/axios.min.js
IP
104.16.125.175:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT

File type

Size
42 kB (41481 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /axios/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /axios@1.6.8/dist/axios.min.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01HS9FZMKPBGCFEN1VBD2QNCEA-arn
cf-cache-status: HIT
age: 237
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 866796bf5d7e569d-OSL
X-Firefox-Spdy: h2

unpkg.com/axios@1.6.8/dist/axios.min.js

104.16.125.175

200 OK

42 kB

URL GET HTTP/2
unpkg.com/axios@1.6.8/dist/axios.min.js
IP
104.16.125.175:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (41442)
Size
42 kB (41481 bytes)
Hash
3b5b3d36fde8ffe8ed76b1efbfc65410
d63107d0912fdb387530d5ce2d512c928d73d122
29d600462a30694efd15b9848b4ca42d178cd067009275c35a30580121114304

HTTP Headers

GET /axios@1.6.8/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://scarletfiles.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"a209-1jEH0JEv2zh1MNXOLVEsko1z0SI"
via: 1.1 fly.io
fly-request-id: 01HS1FGRYZKY14C0JK748EAY1W-arn
cf-cache-status: HIT
age: 269160
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 866796bf7d9b569d-OSL
content-encoding: br
X-Firefox-Spdy: h2

scarletfiles.com/jq/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a2b

104.21.79.46

200 OK

86 kB

URL GET HTTP/3
scarletfiles.com/jq/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a2b
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
JavaScript source, ASCII text, with very long lines (32065)
Size
86 kB (85578 bytes)
Hash
2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /jq/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a2b HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/javascript
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1gKdTWNU6z5WyrMDhvRoCWvNtMK1WKVrz3axlvpE3rpGHGuA1SHK2kSm8FGhI805SfxOfx%2Bta9oV8REyFZ8DAySDdKrYkhQrUVuqZ2%2FL1IImIKILej1rUjTOeHm6rKXVhjS%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796bf0839b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/ASSETS/img/BIMG-65f89457cf151.css

104.21.79.46

200 OK

306 kB

URL GET HTTP/3
scarletfiles.com/ASSETS/img/BIMG-65f89457cf151.css
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Size
306 kB (306493 bytes)
Hash
7d07c247e8dfd5bfaf9a7169b5c402bd
392cc7836ca5418f3e65cc67f5680b2a359399dc
345f500582fb5cfc20df5426c6b54bb0bcaa62eb0249a4a661dc9716a9edc006

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /ASSETS/img/BIMG-65f89457cf151.css HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:22:00 GMT
content-type: image/png
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ojY6X3wP1l5JxX%2BFIYq%2BTkIAl9med%2F4X%2BgF65qjvCZEfU6VBqyU2Ee%2FPm9nqsvaTKIXSGOJYB6jeFGB%2FhhQchAjYo6vnBjE%2F%2BGraOFhZG6wzTQRkABjzhbf9CAwTKoFoUid%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c569f4b50b-OSL
alt-svc: h3=":443"; ma=86400

scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930

104.21.79.46

200 OK

5.5 kB

URL User Request GET HTTP/3
scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
HTML document, ASCII text, with very long lines (5541), with no line terminators
Size
5.5 kB (5502 bytes)
Hash
ff924aadf5c319fe0dd4104edf068ab4
16b853416b4b1db6a541b09583ccd282af510986
1ac5086f4e80ba5df63b57b6fa4dccd107dc842850c78a41ead7f1f30aa790b2

HTTP Headers

GET /beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://scarletfiles.com/Mmichael.fraser@ntt-research.com?__cf_chl_tk=IEzFrEFUYEjE.3CZ7QLTfWxUqbx8wvJOfhAlItLP3w0-1710789712-0.0.1.1-1642
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:58 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CxRFSbQtPF2unjEXamb84CkVsXuCWn6ccV7jj%2FOkw3xcTNgxDJFXG54%2FILH%2BVQS8yPlspfz8FUf2qyCJlrgsEX%2FBsZ4XbhV58tvrrlxFWTEX8bw9fEeFSjH0eUyeYtiV4jTx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796bdfdedb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/jm/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a32

104.21.79.46

200 OK

6.4 kB

URL GET HTTP/3
scarletfiles.com/jm/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a32
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
JavaScript source, ASCII text, with very long lines (6376), with no line terminators
Size
6.4 kB (6357 bytes)
Hash
1e07a363eef4b40ab4a38d5e4371da5c
7351be2a378540a016aec380141927221a45f19b
01ba4de80540981fd34be681b5c1fce8b205e341ac6fa73a61817068ff566510

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /jm/08423d28248f4509907ebb0c9bb0cb0a65f89456b6a32 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/javascript
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zvYQNrtlnzvhLjgmKLNTd3FfAv8E21nivX6vjsXlrOUic8N79g%2BhTO5Tg7aEPLZPRlwOwmgRz%2BkWZfqYTHC3BspcsxaJFT4OUzZ9YxS%2FFP2mZ9KG8GaHAo9Yxogp8iZoT80T"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796bf0842b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/2

104.21.79.46

200 OK

38 kB

URL GET HTTP/3
scarletfiles.com/2
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type

Size
38 kB (38043 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /2 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n3KAuuwKvhBjCvgE0YkYmrT2DFjxepHuNIE5BGMmh4k9cdL8SGkQuE975O6VX3Oj9z8s8GMp2VtzmYJ4y2YU%2FtsrD5FchESOhrBYBIUH%2Fs4KbsYGLMBEnZwo7lSH2d2ZJY%2FH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c0babab50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/favicon.ico

104.21.79.46

404 Not Found

315 B

URL GET HTTP/3
scarletfiles.com/favicon.ico
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
HTML document, ASCII text, with very long lines (326), with no line terminators
Size
315 B (315 bytes)
Hash
97ef40509b73c101d6815511c3adf98d
a4242322497ea630ea72e26ba297a95a2bbe5ccd
322c1f60d9d454c801f7cff3173ef16b61cf9963a64e09a4d9e21d36218b56be

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-cache-status: HIT
age: 60
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GRM0sh3tW14G%2Fs9IR9mOuyu9HZuHigNGCRFKIQn6aJIWrAi%2FahEr0YxrFTD%2F1sJIjWOz4A3ScwRwIqXbqPSH7huRs7E%2FrlD2zZrZDZUSPJc%2Bn1px1gnD2hja7GvJ3p%2B5iETn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 866796c15bd8b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/api-as1f?email=michael.fraser@ntt-research.com&data=logo

104.21.79.46

200 OK

85 B

URL GET HTTP/3
scarletfiles.com/api-as1f?email=michael.fraser@ntt-research.com&data=logo
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
85 B (85 bytes)
Hash
8f2241ba97a88ff7e613aa9d76e9eab0
8a523012eaab4851f7e887506be3adfc857c796e
9d24b5e5c9745eeb6c62975bf3a60c60962090cbe8b56776fdc2dec48e14ca34

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /api-as1f?email=michael.fraser@ntt-research.com&data=logo HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:22:00 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eXRDynim6nG0qiPCNnrTmIA30htNFVJ8yXexwcJUTOejDX97OcrVlgHl97ehkKYWf2y6c19MD%2BBWJ00chp5Qe6nlI9ay7KVJSE1EzhRK7NAyf972OHmBz8kRc9kUFjvwwJ%2Fw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c1bc54b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

scarletfiles.com/ic/08423d28248f4509907ebb0c9bb0cb0a65f894572d788

104.21.79.46

200 OK

17 kB

URL GET HTTP/3
scarletfiles.com/ic/08423d28248f4509907ebb0c9bb0cb0a65f894572d788
IP
104.21.79.46:443
ASN
#13335 CLOUDFLARENET

Requested by
https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Certificate
IssuerLet's Encrypt
Subjectscarletfiles.com
FingerprintC0:E6:26:55:55:C4:73:C6:72:17:8A:B0:98:2D:3E:09:CB:F2:8F:A9
ValidityThu, 07 Mar 2024 04:01:16 GMT - Wed, 05 Jun 2024 04:01:15 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ic/08423d28248f4509907ebb0c9bb0cb0a65f894572d788 HTTP/1.1
Host: scarletfiles.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://scarletfiles.com/beebb091955c06fa68b3eb8afc0bae5165f89456a692dPASbeebb091955c06fa68b3eb8afc0bae5165f89456a6930
Cookie: cf_clearance=rTiTmLlMeIN7unY1wU9RxQELlRjFCVZbJxHUJGsp7cE-1710789712-1.0.1.1-oAtgNLl5ezNcxwS7KMDkNwlspLQ8jBMen4MwFLqe8OpfOuTTlKDfH7jVOBc3XK91VTBTqO6e9tT.BgnH1ERisw; PHPSESSID=201ae526fb6cfdc88a9307ec13932c4a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Mon, 18 Mar 2024 19:21:59 GMT
content-type: image/x-icon
last-modified: Thu, 07 Mar 2024 10:22:13 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HcgMw3S6FeLFIvM8egDyMGK%2Bp6JMj36wV12C6t3mSQd8trDv4v0R0i35uRlBoxljchugnstItfI370IRxQDCG3KOjv1P9uApRxfn1aCzhOYZZFE8JqhN1WfAcnZXhlBn0%2FjQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 866796c4884bb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (31)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash