| 5u5yzr1hk.themagnoliagift.com/bWJydW5ldHRAY29uaWZlcmxsYy5jb20= |  69.49.245.172 | | 1.9 kB |
URL 5u5yzr1hk.themagnoliagift.com/bWJydW5ldHRAY29uaWZlcmxsYy5jb20= IP69.49.245.172:0 ASN#19871 NETWORK-SOLUTIONS-HOSTING
File typeHTML document, ASCII text, with very long lines (1753), with CRLF line terminators Hashf710daeb8f5f7157ca2c298030007deb 479cb12decbb992bb3dedb15f41c367342bb4719 2369e6f479a371bfb387239036d993cdfaadca8d6b525dc619dc5def12f075fb
GET /bWJydW5ldHRAY29uaWZlcmxsYy5jb20= HTTP/1.1
Host: 5u5yzr1hk.themagnoliagift.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 28 Mar 2024 15:25:10 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
|
|
| challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback |  104.17.3.184 | | 0 B |
URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback IP104.17.3.184:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 28 Mar 2024 15:25:11 GMT
content-length: 0
cache-control: max-age=300, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/g/dc6b543c1346/api.js?onload=onloadTurnstileCallback
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b8a1a5585756c6-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com | 104.21.40.201 | 200 OK | 9.1 kB |
URL User Request POST HTTP/3bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com IP104.21.40.201:443
CertificateIssuerGoogle Trust Services LLC Subjectb2a86462b93e78faab471e2e.workers.dev Fingerprint74:86:CD:21:81:11:A2:F1:C8:FA:2C:0B:1F:86:1B:1D:3D:A1:FD:F0 ValidityMon, 19 Feb 2024 00:10:13 GMT - Sun, 19 May 2024 00:10:12 GMT
File typeHTML document, ASCII text, with very long lines (3255), with no line terminators Hash3c4a8624ac03fe7c1314d39663bef118 da36fea14b1c43835c98a14166c9b413ebf99489 1b28c7702729027d7c6485e15744f990013b013e2921be6d22c34bb2aca3887f
GET /?qrc=mbrunett@coniferllc.com HTTP/1.1
Host: bf99e6b1.b2a86462b93e78faab471e2e.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://5u5yzr1hk.themagnoliagift.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 28 Mar 2024 15:25:11 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zhIj%2FL6FC0gPTms1D9IxT4kuAFw6B7DclJwGbCL8y39xzQw84zSF6iFN%2BO2AeC3yNjhs%2Bl6YYVELbvd10J3ZYZN1KCGIrelF8umrR71GvBNZb6SY92ekZpgkZ8WI3xXUvuZSl7%2BOJj1w3lF4Ra2O%2Bu6uJY7LU2d7d5YKDiXET%2Bw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b8a1a31a717128-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1330583637:1711635078:yuaOEe4o4F2HYrEMmV7TdwD_E_aAx-WMXG_ie8CZEBw/86b8a1a63b6456ca/dcaffa49a11ceb8 | 104.17.3.184 | | 7.8 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1330583637:1711635078:yuaOEe4o4F2HYrEMmV7TdwD_E_aAx-WMXG_ie8CZEBw/86b8a1a63b6456ca/dcaffa49a11ceb8 IP104.17.3.184:0
File typeASCII text, with very long lines (968), with no line terminators Hashdf5fd85861886e72fc67dd5df177963f bf3bea5bd13c04c5a437a26dc59e69be74a1bce8 5b57e613a3cd4c3136df055c5cf7a321968595f464d999ea11874146e3ff1c37
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1330583637:1711635078:yuaOEe4o4F2HYrEMmV7TdwD_E_aAx-WMXG_ie8CZEBw/86b8a1a63b6456ca/dcaffa49a11ceb8 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/2gv9z/0x4AAAAAAAVKQ6rN1DvqpjnP/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: dcaffa49a11ceb8
Content-Length: 38389
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Mar 2024 15:25:17 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: A+Kx9Npo2HSqQxFPoIr9rrNtGuITugPBbegQvz/cFIviS4aWI9ItT8zNw9nWdJGFvOuhPgnnGpdi+tCltWJl4lu0sJUM6Vwoi9ORD5eqViQ=$G9dgzqxn3FE8U+VkIZy+Hg==
cf-chl-out-s: 83lBig8RO/fo97z7GHz6WgTeRni5w5xLMIgD3rMKSduXNKpGwzsGIrFjb3nKAVgaqNIaE02TueXRXyKvcXIPEvqAtYDkqVWt6xrVgwvZI+jwZCpF2nhDmcdBfI0Xu7bLMjHxSVrkvq7OFdQEIH9PoQ==$lmunNdabCdtd0nzqFItWbw==
server: cloudflare
cf-ray: 86b8a1c96d6956ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/2gv9z/0x4AAAAAAAVKQ6rN1DvqpjnP/auto/normal | 104.17.3.184 | | 29 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/2gv9z/0x4AAAAAAAVKQ6rN1DvqpjnP/auto/normal IP104.17.3.184:0
File typeHTML document, ASCII text, with very long lines (41919) Hash895fb83f1667dc13f5e62a1e3b373e38 1af2829c628e63fb770452ece1764167d47c5dfb 22d51b1c746e0f5ba1c39bbd4f1fb832808287cd3d8597de54eb492414fa8460
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/2gv9z/0x4AAAAAAAVKQ6rN1DvqpjnP/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Mar 2024 15:25:12 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 86b8a1a63b6456ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/164942136:1711638609:5xcqiphnOXsUkkmQOqVj4-JZm3B7dpfWj_ExUUge6EE/86b8a208398056ca/17067b7ec15bf05 | 104.17.3.184 | | 20 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/164942136:1711638609:5xcqiphnOXsUkkmQOqVj4-JZm3B7dpfWj_ExUUge6EE/86b8a208398056ca/17067b7ec15bf05 IP104.17.3.184:0
File typeASCII text, with very long lines (22604), with no line terminators Hash1635e78a121307e5034a9ee908ccaf8d 8583522e1a2bc98c62fca562136be9ce80caef0d c6d8847220ec9ed7fd7ebdba644f70ebbf0c2633f49a7debec6d6f95ccc85373
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/164942136:1711638609:5xcqiphnOXsUkkmQOqVj4-JZm3B7dpfWj_ExUUge6EE/86b8a208398056ca/17067b7ec15bf05 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv1/LgjrycEEA8PT3fG/2gv9z/0x4AAAAAAAVKQ6rN1DvqpjnP/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 17067b7ec15bf05
Content-Length: 25690
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 28 Mar 2024 15:25:29 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: t0c+PgEUI1Yt72SEsRLsCLGzQhX0oF0pxOOeLeBkwqXSHuKY+cQANKijXI66cQIn$ESJn/ZIc4kvAxniQgkjrgA==
server: cloudflare
cf-ray: 86b8a2117a9156ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| syncotech.net/?qrc=mbrunett%40coniferllc.com |  5.230.69.196 | | 0 B |
URL GET syncotech.net/?qrc=mbrunett%40coniferllc.com IP5.230.69.196:0
Requested byhttps://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?qrc=mbrunett%40coniferllc.com HTTP/1.1
Host: syncotech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=XtE24dxE8qFa; qPdM.sig=OoUb4OTRkPXq-awNpY6yTbiKtqY
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://syncotech.net/owa/?login_hint=mbrunett%40coniferllc.com
Server: Microsoft-IIS/10.0
request-id: 27076509-4f8e-3b5d-0c99-c61064e5860a
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: FR3P281CA0186, FR3P281CA0186
X-RequestId: c54a272f-a6ee-4a2f-a4fb-4ede9c069fca
X-FEProxyInfo: FR3P281CA0186.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
MS-CV: CWUHJ45PXTsMmcYQZOWGCg.0
X-Powered-By: ASP.NET
Date: Thu, 28 Mar 2024 15:25:32 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| syncotech.net/owa/?login_hint=mbrunett%40coniferllc.com | 5.230.69.196 | | 1.4 kB |
URL GET syncotech.net/owa/?login_hint=mbrunett%40coniferllc.com IP5.230.69.196:0
Requested byhttps://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com
File typeHTML document, ASCII text, with very long lines (787), with CRLF, LF line terminators Hashee19eb88090a9bae891f1196eb2a1c67 bba1f391e0d2dbef2c49497f5fe91fa44839c357 a06626078747e796d3fabfcea5a3aff65553f0131050546a4018928b66dcab65
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /owa/?login_hint=mbrunett%40coniferllc.com HTTP/1.1
Host: syncotech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=XtE24dxE8qFa; qPdM.sig=OoUb4OTRkPXq-awNpY6yTbiKtqY
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
content-length: 1367
Content-Type: text/html; charset=utf-8
Location: https://syncotech.net/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1tYnJ1bmV0dCU0MGNvbmlmZXJsbGMuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkxMmNiYmUxLTBlZDEtZTEwNS05MTk2LWMyNjJkMjE5YzQ3MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg0NzIzNjMzMjk4NTU5NDkuYTE5YWRkNzUtY2MwMi00YTRkLWJlMjAtNWZjY2MzYTY2ZDM1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRNYUZGWmdiS3duZ1VRd2VxSkJTU2hzYnJ5LUw5M1pkQ2lPdHdHYVFlRWM3Q2dzNkFCVEItSWZMb3BfRHdJVVpIaWxrYmhRR2pXcFBSaWpabWhtQnRCSkxqdmNfdEYtWlhhWjljMzk5Yy0zTmZqN09tM20tb3VkVzhwYU1VbnJqdGZ3
Server: Microsoft-IIS/10.0
request-id: 912cbbe1-0ed1-e105-9196-c262d219c470
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443",h3-29=":443"
X-CalculatedFETarget: FR4P281CU008.internal.outlook.com
X-BackEndHttpStatus: 302, 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=EBFCE898EA6642A49AAF9A6BAEE1D355; expires=Fri, 28-Mar-2025 15:25:32 GMT; path=/;SameSite=None; secure
ClientId=EBFCE898EA6642A49AAF9A6BAEE1D355; expires=Fri, 28-Mar-2025 15:25:32 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Sat, 28-Sep-2024 15:25:32 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.nonce.v3.kuN8xywzju0kF_NzJOEACOtMTy_oM_pqGssDHcDIW2I=638472363329855949.a19add75-cc02-4a4d-be20-5fccc3a66d35; expires=Thu, 28-Mar-2024 16:25:32 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OptInPrg=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
ClientId=EBFCE898EA6642A49AAF9A6BAEE1D355; expires=Fri, 28-Mar-2025 15:25:32 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Sat, 28-Sep-2024 15:25:32 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=syncotech.net; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OpenIdConnect.nonce.v3.kuN8xywzju0kF_NzJOEACOtMTy_oM_pqGssDHcDIW2I=638472363329855949.a19add75-cc02-4a4d-be20-5fccc3a66d35; expires=Thu, 28-Mar-2024 16:25:32 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
OptInPrg=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Mon, 28-Mar-1994 15:25:32 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14BzSEuTztP3Ag; expires=Thu, 28-Mar-2024 21:27:32 GMT; path=/;SameSite=None; secure; HttpOnly
X-CalculatedBETarget: FRYP281MB3186.DEUP281.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS6
X-OWA-DiagnosticsInfo: 2;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-03-28T15:25:32.985
X-BackEnd-End: 2024-03-28T15:25:32.985
X-DiagInfo: FRYP281MB3186
X-BEServer: FRYP281MB3186
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
X-Proxy-BackendServerStatus: 302
X-FEProxyInfo: FR3P281CA0192.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
X-FEServer: FR4P281CA0107, FR3P281CA0192
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-FirstHopCafeEFZ: HHN
Date: Thu, 28 Mar 2024 15:25:32 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| syncotech.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3N5bmNvdGVjaC5uZXQiLCJkb21haW4iOiJzeW5jb3RlY2gubmV0Iiwia2V5IjoiWHRFMjRkeEU4cUZhIiwicXJjIjoibWJydW5ldHRAY29uaWZlcmxsYy5jb20iLCJpYXQiOjE3MTE2Mzk1MzIsImV4cCI6MTcxMTYzOTY1Mn0.R1tuZR_XPegX9_oNMBUc9D3xM6s7k70XXr0QXZTQWEk | 0.0.0.0 | | 0 B |
URL GET syncotech.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3N5bmNvdGVjaC5uZXQiLCJkb21haW4iOiJzeW5jb3RlY2gubmV0Iiwia2V5IjoiWHRFMjRkeEU4cUZhIiwicXJjIjoibWJydW5ldHRAY29uaWZlcmxsYy5jb20iLCJpYXQiOjE3MTE2Mzk1MzIsImV4cCI6MTcxMTYzOTY1Mn0.R1tuZR_XPegX9_oNMBUc9D3xM6s7k70XXr0QXZTQWEk IP0.0.0.0:0
Requested byhttps://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL3N5bmNvdGVjaC5uZXQiLCJkb21haW4iOiJzeW5jb3RlY2gubmV0Iiwia2V5IjoiWHRFMjRkeEU4cUZhIiwicXJjIjoibWJydW5ldHRAY29uaWZlcmxsYy5jb20iLCJpYXQiOjE3MTE2Mzk1MzIsImV4cCI6MTcxMTYzOTY1Mn0.R1tuZR_XPegX9_oNMBUc9D3xM6s7k70XXr0QXZTQWEk HTTP/1.1
Host: syncotech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=XtE24dxE8qFa; path=/; samesite=none; secure; httponly
qPdM.sig=OoUb4OTRkPXq-awNpY6yTbiKtqY; path=/; samesite=none; secure; httponly
location: /?qrc=mbrunett%40coniferllc.com
Date: Thu, 28 Mar 2024 15:25:32 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/favicon.ico | 104.21.40.201 | 200 OK | 3.3 kB |
URL GET HTTP/3bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/favicon.ico IP104.21.40.201:443
Requested byhttps://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com CertificateIssuerGoogle Trust Services LLC Subjectb2a86462b93e78faab471e2e.workers.dev Fingerprint74:86:CD:21:81:11:A2:F1:C8:FA:2C:0B:1F:86:1B:1D:3D:A1:FD:F0 ValidityMon, 19 Feb 2024 00:10:13 GMT - Sun, 19 May 2024 00:10:12 GMT
File typeHTML document, ASCII text, with very long lines (3271), with no line terminators Hasha08e7fdf010a65d7a9d000a802d0d329 52e4979984ac960ad9a5b211e0a7daaf776edb49 863348d8d640d9842933cd86e8101c2d499e531d9fd95298a320dee290d1c8ce
GET /favicon.ico HTTP/1.1
Host: bf99e6b1.b2a86462b93e78faab471e2e.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 28 Mar 2024 15:25:32 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jOPj2GTa2mkicEqCJy%2BIcPZ8UeQ4UhseDLISJiIWNifMfvuS6CYtsY5XY3cIXwhAsX8W5VYj%2ByaY%2FrD3rUUWRZo4yzMxmDo%2FEK0uqX6KgrBCGVOC7qysP80BK%2BJh1cr5mfrcnTOFUSiPQ%2BxrsKzucmRd7MZGXthw2vVgfBqJwYU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b8a2276c437128-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| syncotech.net/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1tYnJ1bmV0dCU0MGNvbmlmZXJsbGMuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkxMmNiYmUxLTBlZDEtZTEwNS05MTk2LWMyNjJkMjE5YzQ3MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg0NzIzNjMzMjk4NTU5NDkuYTE5YWRkNzUtY2MwMi00YTRkLWJlMjAtNWZjY2MzYTY2ZDM1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRNYUZGWmdiS3duZ1VRd2VxSkJTU2hzYnJ5LUw5M1pkQ2lPdHdHYVFlRWM3Q2dzNkFCVEItSWZMb3BfRHdJVVpIaWxrYmhRR2pXcFBSaWpabWhtQnRCSkxqdmNfdEYtWlhhWjljMzk5Yy0zTmZqN09tM20tb3VkVzhwYU1VbnJqdGZ3 | 0.0.0.0 | | 0 B |
URL GET syncotech.net/captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1tYnJ1bmV0dCU0MGNvbmlmZXJsbGMuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkxMmNiYmUxLTBlZDEtZTEwNS05MTk2LWMyNjJkMjE5YzQ3MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg0NzIzNjMzMjk4NTU5NDkuYTE5YWRkNzUtY2MwMi00YTRkLWJlMjAtNWZjY2MzYTY2ZDM1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRNYUZGWmdiS3duZ1VRd2VxSkJTU2hzYnJ5LUw5M1pkQ2lPdHdHYVFlRWM3Q2dzNkFCVEItSWZMb3BfRHdJVVpIaWxrYmhRR2pXcFBSaWpabWhtQnRCSkxqdmNfdEYtWlhhWjljMzk5Yy0zTmZqN09tM20tb3VkVzhwYU1VbnJqdGZ3 IP0.0.0.0:0
Requested byhttps://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/?qrc=mbrunett@coniferllc.com
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /captcha.rdr?ref=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1tYnJ1bmV0dCU0MGNvbmlmZXJsbGMuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkxMmNiYmUxLTBlZDEtZTEwNS05MTk2LWMyNjJkMjE5YzQ3MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg0NzIzNjMzMjk4NTU5NDkuYTE5YWRkNzUtY2MwMi00YTRkLWJlMjAtNWZjY2MzYTY2ZDM1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRNYUZGWmdiS3duZ1VRd2VxSkJTU2hzYnJ5LUw5M1pkQ2lPdHdHYVFlRWM3Q2dzNkFCVEItSWZMb3BfRHdJVVpIaWxrYmhRR2pXcFBSaWpabWhtQnRCSkxqdmNfdEYtWlhhWjljMzk5Yy0zTmZqN09tM20tb3VkVzhwYU1VbnJqdGZ3 HTTP/1.1
Host: syncotech.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://bf99e6b1.b2a86462b93e78faab471e2e.workers.dev/
DNT: 1
Connection: keep-alive
Cookie: qPdM=XtE24dxE8qFa; qPdM.sig=OoUb4OTRkPXq-awNpY6yTbiKtqY; ClientId=EBFCE898EA6642A49AAF9A6BAEE1D355; OIDC=1; OpenIdConnect.nonce.v3.kuN8xywzju0kF_NzJOEACOtMTy_oM_pqGssDHcDIW2I=638472363329855949.a19add75-cc02-4a4d-be20-5fccc3a66d35; X-OWA-RedirectHistory=ArLym14BzSEuTztP3Ag
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|