Report - postoffice.kmzlift.ru/owa/

Report Overview

Visited public
2025-05-05 03:35:29
Tags
microsoft phishing
URL
postoffice.kmzlift.ru/owa/
Finishing URL
postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
IP / ASN
82.112.190.237
#43267 JSC Severen-Telecom
Title
Outlook Web App
Phishing - Microsoft

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
postoffice.kmzlift.ru	unknown	2003-03-04	2025-05-05	2025-05-05	12 kB	55 kB	87.239.24.57

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js	ScriptElement	4.3 kB	2023-03-07	2025-05-05
Pretty URL postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js IP 82.112.190.237 ASN #43267 JSC Severen-Telecom Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:45 Last Seen2025-05-05 03:35 Times Seen81 Hash c5117acab776c21fdd2de21f15fa9d6f 9dc4578b5992446515abc5763cd0898f88bcd35e 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060 Loading...

	postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js	ScriptElement	4.3 kB	2023-03-07	2025-05-05
Pretty URL postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js IP 82.112.190.237 ASN #43267 JSC Severen-Telecom Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:45 Last Seen2025-05-05 03:35 Times Seen81 Hash c5117acab776c21fdd2de21f15fa9d6f 9dc4578b5992446515abc5763cd0898f88bcd35e 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060 Loading...

	postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f	ScriptElement	1.4 kB	2023-03-07	2025-05-05
Pretty URL postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f IP 87.239.24.57 ASN #35598 Inetcom Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 13:45 Last Seen2025-05-05 03:35 Times Seen9 Hash f32b6f121b35df45af0ae6b34e4ccce4 6c1a4d12ae3ac8030bef13101f8eba95f68db9c2 be3ef08a2489ba68e82a4f3eb3f70d884f23e36b4a545deff0a1563c9c1d011a Loading...

	postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f	ScriptElement	16 B	2023-03-07	2025-05-05
Pretty URL postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f IP 87.239.24.57 ASN #35598 Inetcom Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 13:45 Last Seen2025-05-05 03:35 Times Seen11 Hash 96fdab8179624e499621bfb5661f0248 c7d52243908346b1f2ed66e1127fe40263eec70b 478004b550fa09e9ac76c02710c49edd3081fb4e65014647643b7e1a8884d6ae Loading...

	postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0	ScriptElement	229 B	2025-05-05	2025-05-05
Pretty URL postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0 IP 87.239.24.57 ASN #35598 Inetcom Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-05 03:35 Last Seen2025-05-05 03:35 Times Seen1 Hash d8c1980deabaf78c61f9ef04a047e425 91e31b6f59ecb6899ac9d23b615559d44dbae0e2 5208dc517103b3574a577d62e46418d383476786d6c4d1698063a4184d27fbed Loading...

HTTP Transactions (19)

URL IP Response Size

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnleft.gif

87.239.24.57

200 OK

290 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnleft.gif
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 15 x 200
Size
290 B (290 bytes)
Hash
baf34665612f4d59f7cfc06ea82da21d
2c8cf5f76499e66d609ddaac026720ef28078421
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnleft.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 290

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnright.gif

82.112.190.237

200 OK

306 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnright.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 15 x 200
Size
306 B (306 bytes)
Hash
391603f1faee60db855bd11650dbbf72
9728452459447efcc7c453c2150139839fa174bc
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnright.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 306

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/owafont.css

87.239.24.57

200 OK

4.8 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/owafont.css
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
ASCII text, with very long lines (1034), with CRLF line terminators
Size
4.8 kB (4822 bytes)
Hash
d0fc53724ee34d86cb3de756e7d55a7d
a0de8c5de11e42a11548d67fb40c4c6c5562a2cb
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/owafont.css HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:57 GMT
Content-Length: 1554

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopl.gif

82.112.190.237

200 OK

4.5 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopl.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 456 x 115
Size
4.5 kB (4455 bytes)
Hash
6ae33a65d15f6bb5113e066fca7fa73a
fa8477f0eaed3ade4a217e91133ba37242be0c19
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgntopl.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 4455

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotr.gif

82.112.190.237

200 OK

2.4 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotr.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 45 x 54
Size
2.4 kB (2392 bytes)
Hash
43b7c46b32691aa778c5e49d139db8f5
e72b87c696eed81b71b853ce245a30377dce205e
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnbotr.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 2392

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnexlogo.gif

82.112.190.237

200 OK

61 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnexlogo.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 22 x 22
Size
61 B (61 bytes)
Hash
873c522598fb6da9f70d5dde7ccf6213
c09fdcf5e3933b8efdae4505825e786462cdad51
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnexlogo.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 61

postoffice.kmzlift.ru/owa/

87.239.24.57

302 Moved Temporarily

1.5 kB

URL User Request GET
postoffice.kmzlift.ru/owa/
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type

Size
1.5 kB (1505 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/ HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Set-Cookie: sessionid=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
cadata=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
Date: Mon, 05 May 2025 03:34:57 GMT

postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0

87.239.24.57

200 OK

1.5 kB

URL User Request GET
postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
HTML document, ASCII text, with very long lines (365), with CRLF, LF line terminators
Size
1.5 kB (1505 bytes)
Hash
975439e87ec1123614b281825292df85
5c31ca01863269c156ec2fc8ddfee96571ebced8
a9e0bb7f70de6af5e5ec4dc992c197674ee9847b7ff30763f1807d76b98e9113

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0 HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Set-Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d; path=/; secure; HttpOnly
X-OWA-Version: 14.3.513.0
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:57 GMT
Content-Length: 988

postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js

82.112.190.237

200 OK

4.3 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
ASCII text, with very long lines (4296), with no line terminators
Size
4.3 kB (4296 bytes)
Hash
c5117acab776c21fdd2de21f15fa9d6f
9dc4578b5992446515abc5763cd0898f88bcd35e
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/scripts/premium/flogon.js HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: application/x-javascript
Content-Encoding: gzip
Last-Modified: Tue, 28 Nov 2017 16:23:50 GMT
Accept-Ranges: bytes
ETag: "02fb466568d31:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 1671

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopr.gif

87.239.24.57

200 OK

581 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopr.gif
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 45 x 115
Size
581 B (581 bytes)
Hash
031bed6f568fbddddf550a97400b273f
69342ba98b1a924ea4f984f5ef6b244ba0177cb3
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgntopr.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 581

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopm.gif

82.112.190.237

200 OK

58 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgntopm.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 1 x 115
Size
58 B (58 bytes)
Hash
0615717b3645a8573f07347cdb74d69f
b707c5a9ede57d3232138ed7ccdb0b4ee9e56043
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgntopm.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 58

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotm.gif

82.112.190.237

200 OK

276 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotm.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 1 x 54
Size
276 B (276 bytes)
Hash
704330b6d293ce2d32780739218696b9
6ebd408ff617f5317595121191a92bd9ba69a01f
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnbotm.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 276

postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f

87.239.24.57

200 OK

9.2 kB

URL User Request GET
postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
HTML document, ASCII text, with very long lines (440), with CRLF, LF line terminators
Size
9.2 kB (9151 bytes)
Hash
2b756e239353373e1eda844cf958cd78
12465552f271e5378d6d499c1a4e99e351fd426e
4beb177e5e0b43723573dafe298fc8b234e4919594226b1f69b9e9a5c6c9f1dd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
X-OWA-Version: 14.3.513.0
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 3315

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css

87.239.24.57

200 OK

2.5 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
ASCII text, with very long lines (1008), with CRLF line terminators
Size
2.5 kB (2521 bytes)
Hash
2d0333f5bfc005f284ccf423fa9db871
3324e452de752ebd1401207548c6f8c3d84eca76
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/logon.css HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 1037

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/owafont.css

82.112.190.237

200 OK

4.8 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/owafont.css
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
ASCII text, with very long lines (1034), with CRLF line terminators
Size
4.8 kB (4822 bytes)
Hash
d0fc53724ee34d86cb3de756e7d55a7d
a0de8c5de11e42a11548d67fb40c4c6c5562a2cb
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/owafont.css HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 1554

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotl.gif

82.112.190.237

200 OK

9.3 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/lgnbotl.gif
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
GIF image data, version 89a, 456 x 54
Size
9.3 kB (9311 bytes)
Hash
e0a2c263c6745f251720fe0876d140c4
51b2196c6b10b8c6443e4f91b4c6281134755f33
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/lgnbotl.gif HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/gif
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 9311

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css

87.239.24.57

200 OK

2.5 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/logon.css
IP
87.239.24.57:443
ASN
#35598 Inetcom Carrier LLC

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
ASCII text, with very long lines (1008), with CRLF line terminators
Size
2.5 kB (2521 bytes)
Hash
2d0333f5bfc005f284ccf423fa9db871
3324e452de752ebd1401207548c6f8c3d84eca76
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/logon.css HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: text/css
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:57 GMT
Content-Length: 1037

postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js

82.112.190.237

200 OK

0 B

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/scripts/premium/flogon.js
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/scripts/premium/flogon.js HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?url=https://postoffice.kmzlift.ru/owa/&reason=0
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: application/x-javascript
Content-Encoding: gzip
Last-Modified: Tue, 28 Nov 2017 16:23:50 GMT
Accept-Ranges: bytes
ETag: "02fb466568d31:0"
Vary: Accept-Encoding
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 1671

postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/favicon.ico

82.112.190.237

200 OK

1.2 kB

URL GET
postoffice.kmzlift.ru/owa/14.3.513.0/themes/resources/favicon.ico
IP
82.112.190.237:443
ASN
#43267 JSC Severen-Telecom

Requested by
https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Certificate
IssuerGlobalSign nv-sa
Subject*.kmzlift.ru
Fingerprint3C:F6:7B:F3:9A:32:34:C4:CD:FD:7A:DA:1A:E0:61:F7:44:0A:6F:2E
ValidityWed, 15 Jan 2025 06:26:36 GMT - Mon, 16 Feb 2026 06:26:35 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
af0e7a63be394e3d5b0691ff91f4f3ea
dec8da70db061c6ae95d5ccb0a59fdf7c06f0245
164ae0034b553725938a2493e7fc42c87c19d2b1af730f5b00dec91f75957e0a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /owa/14.3.513.0/themes/resources/favicon.ico HTTP/1.1
Host: postoffice.kmzlift.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://postoffice.kmzlift.ru/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fpostoffice.kmzlift.ru%2fowa%2f
Cookie: OutlookSession=d56b3630dda24400bd6639e0b62fd05d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/x-icon
Last-Modified: Tue, 05 Feb 2013 20:00:46 GMT
Accept-Ranges: bytes
ETag: "06b647cdb3ce1:0"
X-Powered-By: ASP.NET
Date: Mon, 05 May 2025 03:34:58 GMT
Content-Length: 1150

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (19)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP