Report - securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

Report Overview

Submitted URL
securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
IP
20.211.64.0
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Submitted
2024-04-25 07:44:24
Access
public
Website Title
Sign in
Final URL
securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Tags
salesforce phishing
urlquery detections
Phishing - Salesforce

Detections

urlquery
10
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
securityservice.me	unknown	2022-02-09	2019-02-20	2022-07-28	4.6 kB	150 kB	20.211.64.0

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	securityservice.me/lib/jquery/dist/jquery.min.js	90 kB	2023-03-07	2024-05-04
Pretty URL securityservice.me/lib/jquery/dist/jquery.min.js IP 20.211.64.0 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:09 Last Seen2024-05-04 11:00:49 Times Seen14248 Hash b61aa6e2d68d21b3546b5b418bf0e9c3 9c1398f0de4c869dacb1c9ab1a8cc327f5421ff7 f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b Loading...

	securityservice.me/lib/bootstrap/dist/js/bootstrap.bundle.min.js	79 kB	2023-03-07	2024-05-03
Pretty URL securityservice.me/lib/bootstrap/dist/js/bootstrap.bundle.min.js IP 20.211.64.0 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:18 Last Seen2024-05-03 06:52:06 Times Seen411 Hash b41fe9374205bd087a4d4f0ab5a195be ff398162cf8cbdbaa30110512524ecce2ca040be 5d97e438677a16e845f3c8791a0126448a576e6fa1064168ef8c980cf639adbc Loading...

	securityservice.me/js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0	227 B	2023-03-07	2024-05-03
Pretty URL securityservice.me/js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0 IP 20.211.64.0 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 21:58:31 Last Seen2024-05-03 06:52:06 Times Seen182 Hash 25809d7e2cec09c0b359b3d6aa9a94fa 9978f622f5c761a4179277be3f9ed4273fd7a767 33f35692fd57e7407f9a7a650fcc5cc12b828824f44f8f2c4d133323d87b3c11 Loading...

HTTP Transactions (9)

URL IP Response Size

securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

20.211.64.0

200 OK

1.1 kB

URL User Request GET HTTP/1.1
securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
HTML document, ASCII text, with CRLF line terminators
Size
1.1 kB (1129 bytes)
Hash
dbe2823cf42c0ebe6189c662976aba2e
a2e59f6282d00a229688185a4bf813236f740bf4
104b3e5b401f7c251f00de0632a84560faf7beec8ed88cacfe991c636fe92351

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000 HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 1129
Content-Type: text/html; charset=utf-8
Date: Thu, 25 Apr 2024 07:43:59 GMT
Server: Microsoft-IIS/10.0
Content-Encoding: gzip
Set-Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617;Path=/;HttpOnly;Domain=securityservice.me
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/css/site.css

20.211.64.0

200 OK

809 B

URL GET HTTP/1.1
securityservice.me/css/site.css
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size
809 B (809 bytes)
Hash
6c33295c59433276904aab6321f24544
8d3858b14ccccfbab20d31f2b4d82222b67d9adf
4b68a19b330515cdc55a6056b11f8d89d75959af246f2690601c76143908a07b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /css/site.css HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 809
Content-Type: text/css
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d952639a69bd09"
Last-Modified: Thu, 09 Mar 2023 08:46:13 GMT
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0

20.211.64.0

200 OK

299 B

URL GET HTTP/1.1
securityservice.me/js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size
299 B (299 bytes)
Hash
2812bf3ec7cf0045acebe842d28c0ec2
64e5e8b49e91c203517cd9160291ee6769824d16
e2ad63c0585a3da660afc580512aeec7a840ba1d170e0f643d2df1215ab7e88d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0 HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 299
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d952639b024fe6"
Last-Modified: Thu, 09 Mar 2023 08:46:14 GMT
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/lib/bootstrap/dist/css/bootstrap.min.css

20.211.64.0

200 OK

36 kB

URL GET HTTP/1.1
securityservice.me/lib/bootstrap/dist/css/bootstrap.min.css
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
ASCII text, with very long lines (65319), with CRLF line terminators
Size
36 kB (35478 bytes)
Hash
8fe70898895271ddc62823321011273a
60f0159744e3b554a45da027f9e7faa992aed71a
ae576713bc196098f7438dede6ff1f835a23291c32b745ad7e6fb6db809a719b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /lib/bootstrap/dist/css/bootstrap.min.css HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d95263cdae27f4"
Last-Modified: Thu, 09 Mar 2023 08:47:39 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/css/landing/WeTransferSignIn.css

20.211.64.0

200 OK

3.4 kB

URL GET HTTP/1.1
securityservice.me/css/landing/WeTransferSignIn.css
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (2018), with CRLF line terminators
Size
3.4 kB (3398 bytes)
Hash
673fad4f9e081496dddcfc149e1d6197
2cce336e64af445b6952584b04a6a40dbe824055
70031e156951c4e75ce42bcee34e7c3c8ec7c938496e100fbb52be50be26d3d9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /css/landing/WeTransferSignIn.css HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: text/css
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d95263a524539d"
Last-Modified: Thu, 09 Mar 2023 08:46:31 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/lib/jquery/dist/jquery.min.js

20.211.64.0

200 OK

40 kB

URL GET HTTP/1.1
securityservice.me/lib/jquery/dist/jquery.min.js
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators
Size
40 kB (39750 bytes)
Hash
b61aa6e2d68d21b3546b5b418bf0e9c3
9c1398f0de4c869dacb1c9ab1a8cc327f5421ff7
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /lib/jquery/dist/jquery.min.js HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d95263c7b73b06"
Last-Modified: Thu, 09 Mar 2023 08:47:29 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/lib/bootstrap/dist/js/bootstrap.bundle.min.js

20.211.64.0

200 OK

30 kB

URL GET HTTP/1.1
securityservice.me/lib/bootstrap/dist/js/bootstrap.bundle.min.js
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
JavaScript source, ASCII text, with very long lines (65292), with CRLF line terminators
Size
30 kB (30171 bytes)
Hash
b41fe9374205bd087a4d4f0ab5a195be
ff398162cf8cbdbaa30110512524ecce2ca040be
5d97e438677a16e845f3c8791a0126448a576e6fa1064168ef8c980cf639adbc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /lib/bootstrap/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/javascript
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
Content-Encoding: gzip
ETag: "1d95263cf773831"
Last-Modified: Thu, 09 Mar 2023 08:47:42 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By: ASP.NET

securityservice.me/images/landing/wetrafr.svg

20.211.64.0

200 OK

4.5 kB

URL GET HTTP/1.1
securityservice.me/images/landing/wetrafr.svg
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
SVG Scalable Vector Graphics image
Size
4.5 kB (4499 bytes)
Hash
6951b97f4c4a60115bff464f843fb124
920fbbe8292f33ea4cc0388d40ed5654dc5fa98d
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /images/landing/wetrafr.svg HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 4499
Content-Type: image/svg+xml
Date: Thu, 25 Apr 2024 07:44:00 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
ETag: "1d95263c4bb6793"
Last-Modified: Thu, 09 Mar 2023 08:47:24 GMT
X-Powered-By: ASP.NET

securityservice.me/favicon.ico

20.211.64.0

200 OK

32 kB

URL GET HTTP/1.1
securityservice.me/favicon.ico
IP
20.211.64.0:80
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000

File type
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
32 kB (32038 bytes)
Hash
4859e39ae6c0f1f428f2126a6bb32bd9
1c0c85678ae963bc96d0b7fbe1eb89074cf1fbe0
a94f8a8553caea8430dd4ca3cc01d4e318d19828f74cb65453ffb7f5d9e2f44d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Salesforce

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: securityservice.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://securityservice.me/sign-in/b3cfebc6960b4fea9c0639caf69036e2/00000000-0000-0000-0000-000000000000
Cookie: ARRAffinity=d7660579d47689d1b5446c44a619502be486eb528015f9d2b83e860743438617
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 32038
Content-Type: image/x-icon
Date: Thu, 25 Apr 2024 07:44:01 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
ETag: "1d952639a69c5a6"
Last-Modified: Thu, 09 Mar 2023 08:46:13 GMT
X-Powered-By: ASP.NET

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size