| m.exactag.com/ai.aspx?tc=d9231133bc40b07205bbd26a23a8d2e6b6b4f9&url=http:tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= |  85.14.248.91 | | 0 B |
URL m.exactag.com/ai.aspx?tc=d9231133bc40b07205bbd26a23a8d2e6b6b4f9&url=http:tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= IP85.14.248.91:0 ASN#24961 myLoc managed IT AG
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ai.aspx?tc=d9231133bc40b07205bbd26a23a8d2e6b6b4f9&url=http:tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= HTTP/1.1
Host: m.exactag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Connection: close
Date: Tue, 07 May 2024 16:38:46 GMT
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Di, 07 Mai 2024 04:38:47 GMT
Location: http:tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20=
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
X-ET-Code: 20
X-ET-Camp: 0
X-ET-Monitoring: 1
Strict-Transport-Security: max-age=31536000
cross-origin-resource-policy: cross-origin
X-Xss-Protection: 0
X-Content-Type-Options: nosniff
|
|
| tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= |  69.49.245.172 | | 0 B |
URL tinymightyhabits.com/winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= IP69.49.245.172:0 ASN#19871 NETWORK-SOLUTIONS-HOSTING
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /winners/46383//a2V2aW5fZmxhY2hAYWdpbGVudC5jb20= HTTP/1.1
Host: tinymightyhabits.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 07 May 2024 16:38:46 GMT
Server: Apache
refresh: 0;url=https://gopowerssolutions.com/?abnhljlk&email=kevin_flach@agilent.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| gopowerssolutions.com/?abnhljlk&email=kevin_flach@agilent.com | 5.230.70.60 | 302 Found | 0 B |
URL User Request GET HTTP/1.1gopowerssolutions.com/?abnhljlk&email=kevin_flach@agilent.com IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectgopowerssolutions.com FingerprintE4:20:E0:0B:24:10:E8:C4:14:E5:4E:9C:1E:0C:56:7E:6A:4C:C5:B8 ValidityThu, 25 Apr 2024 03:18:30 GMT - Wed, 24 Jul 2024 03:18:29 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?abnhljlk&email=kevin_flach@agilent.com HTTP/1.1
Host: gopowerssolutions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=vI3Fl1WxXZ4N; path=/; samesite=none; secure; httponly
qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; path=/; samesite=none; secure; httponly
location: https://bldllcs.net?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJ2STNGbDFXeFhaNE4iLCJxcmMiOiJrZXZpbl9mbGFjaEBhZ2lsZW50LmNvbSIsImlhdCI6MTcxNTA5OTkyNywiZXhwIjoxNzE1MTAwMDQ3fQ.pSSk29L10ubFGWXoAsmljbwKCjBRTGIfoC3wXxtN7FU
Date: Tue, 07 May 2024 16:38:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| bldllcs.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJ2STNGbDFXeFhaNE4iLCJxcmMiOiJrZXZpbl9mbGFjaEBhZ2lsZW50LmNvbSIsImlhdCI6MTcxNTA5OTkyNywiZXhwIjoxNzE1MTAwMDQ3fQ.pSSk29L10ubFGWXoAsmljbwKCjBRTGIfoC3wXxtN7FU | 5.230.70.60 | 302 Found | 0 B |
URL User Request GET HTTP/1.1bldllcs.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJ2STNGbDFXeFhaNE4iLCJxcmMiOiJrZXZpbl9mbGFjaEBhZ2lsZW50LmNvbSIsImlhdCI6MTcxNTA5OTkyNywiZXhwIjoxNzE1MTAwMDQ3fQ.pSSk29L10ubFGWXoAsmljbwKCjBRTGIfoC3wXxtN7FU IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJ2STNGbDFXeFhaNE4iLCJxcmMiOiJrZXZpbl9mbGFjaEBhZ2lsZW50LmNvbSIsImlhdCI6MTcxNTA5OTkyNywiZXhwIjoxNzE1MTAwMDQ3fQ.pSSk29L10ubFGWXoAsmljbwKCjBRTGIfoC3wXxtN7FU HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=vI3Fl1WxXZ4N; path=/; samesite=none; secure; httponly
qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; path=/; samesite=none; secure; httponly
location: /?qrc=kevin_flach%40agilent.com
Date: Tue, 07 May 2024 16:38:47 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| bldllcs.net/?qrc=kevin_flach%40agilent.com | 5.230.70.60 | 302 Moved Temporarily | 0 B |
URL User Request GET HTTP/1.1bldllcs.net/?qrc=kevin_flach%40agilent.com IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?qrc=kevin_flach%40agilent.com HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://bldllcs.net/owa/?login_hint=kevin_flach%40agilent.com
Server: Microsoft-IIS/10.0
request-id: 48f53220-9831-d100-8571-20a26a892a4b
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: FR3P281CA0114, FR3P281CA0114
X-RequestId: 61b3fa79-10f7-46d2-bf14-8def66a57a36
X-FEProxyInfo: FR3P281CA0114.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
MS-CV: IDL1SDGYANGFcSCiaokqSw.0
X-Powered-By: ASP.NET
Date: Tue, 07 May 2024 16:38:48 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| bldllcs.net/owa/?login_hint=kevin_flach%40agilent.com | 5.230.70.60 | 302 Found | 1.4 kB |
URL User Request GET HTTP/1.1bldllcs.net/owa/?login_hint=kevin_flach%40agilent.com IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typeHTML document, ASCII text, with very long lines (781), with CRLF, LF line terminators Hash7a777e9b8c8e90c32134f8dd9317683a 7140443f1c5b5bd16f42db2259bee6e766e75ade 47b0508cdd6c74102b3dbdcc328fdc1664fca19a0f3ec28f745c47f9e542db21
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /owa/?login_hint=kevin_flach%40agilent.com HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
content-length: 1361
Content-Type: text/html; charset=utf-8
Location: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZXZpbl9mbGFjaCU0MGFnaWxlbnQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTgzOTg2ZmQzLTY5M2MtYWQzNS0yYzYyLTg4ZDgzMGQwZmJmZiZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5NjcyODM2MjI4NDYuZjNiM2FhMGYtMGVhYS00MzFiLWE4NWEtMGU1N2U4MTc1YjcwJnN0YXRlPURZdExEc0l3REFVVE9Bc2JwTFJ1ZmpZTHhGR1FVeVZ0Ukpwc0tyZy1Yc3pUdk1Wb3BkUlZ1QWdhWkJSR1J3SGlJNklsRjYwbEg2ZmlrbU9HWWlBekctLVdaSmdDeXcyWWFjR1FFTFMwOTNuOGVINjFzZFgtM21zX241XzhGUzJOMV8zbWdiZmFjai1uZFJ4Xw==
Server: Microsoft-IIS/10.0
request-id: 83986fd3-693c-ad35-2c62-88d830d0fbff
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedFETarget: BE1P281CU012.internal.outlook.com
X-BackEndHttpStatus: 302, 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=2767CD76749F41F1A10AE9BAF84C4F71; expires=Wed, 07-May-2025 16:38:48 GMT; path=/;SameSite=None; secure
ClientId=2767CD76749F41F1A10AE9BAF84C4F71; expires=Wed, 07-May-2025 16:38:48 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Thu, 07-Nov-2024 16:38:48 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; expires=Tue, 07-May-2024 17:38:48 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OptInPrg=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
ClientId=2767CD76749F41F1A10AE9BAF84C4F71; expires=Wed, 07-May-2025 16:38:48 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Thu, 07-Nov-2024 16:38:48 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=bldllcs.net; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; expires=Tue, 07-May-2024 17:38:48 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
OptInPrg=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 07-May-1994 16:38:48 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; expires=Tue, 07-May-2024 22:40:48 GMT; path=/;SameSite=None; secure; HttpOnly
X-CalculatedBETarget: BE1SPRMB0008.DEUP281.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS7
X-OWA-DiagnosticsInfo: 2;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-05-07T16:38:48.346
X-BackEnd-End: 2024-05-07T16:38:48.362
X-DiagInfo: BE1SPRMB0008
X-BEServer: BE1SPRMB0008
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
X-Proxy-BackendServerStatus: 302
X-FEProxyInfo: FR3P281CA0034.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
X-FEServer: BE1P281CA0129, FR3P281CA0034
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-FirstHopCafeEFZ: HHN
Date: Tue, 07 May 2024 16:38:47 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== | 5.230.70.60 | 200 OK | 25 kB |
URL User Request GET HTTP/1.1bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typeJavaScript source, ASCII text, with very long lines (1161), with CRLF, LF line terminators Hash882bdb0ac9c6a6afc1142e313c07987d 69a63363964543efc8f0dde6033cd4db70661423 2ece434db0c63265612ff488915f67c3715f5aecc25372e3a7a7ef4a4f4198c4
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: no-cache,no-store
Pragma: no-cache
content-length: 24819
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 07 May 2024 16:38:50 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| bldllcs.net/adfs/portal/css/style.css?id=DBC0B4741D4217A138377E7BCC747D0D30B93B979DC99146E4C4016785BA8C42 | 5.230.70.60 | 200 OK | 7.8 kB |
URL GET HTTP/1.1bldllcs.net/adfs/portal/css/style.css?id=DBC0B4741D4217A138377E7BCC747D0D30B93B979DC99146E4C4016785BA8C42 IP5.230.70.60:443
Requested byhttps://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typeUnicode text, UTF-8 (with BOM) text, with CRLF line terminators Hashc79f5e7fa4dce166f74447b71da0b090 afb84eb0b0b4b871239665dae3b246a98bf9d631 dbc0b4741d4217a138377e7bcc747d0d30b93b979dc99146e4c4016785ba8c42
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /adfs/portal/css/style.css?id=DBC0B4741D4217A138377E7BCC747D0D30B93B979DC99146E4C4016785BA8C42 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw==
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 7829
Content-Type: text/css
Expires: Thu, 06 Jun 2024 16:38:51 GMT
ETag: DBC0B4741D4217A138377E7BCC747D0D30B93B979DC99146E4C4016785BA8C42
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 07 May 2024 16:38:51 GMT
Connection: close
|
|
| bldllcs.net/adfs/portal/logo/logo.png?id=E1D28D47BC995ED3B42A20FCFB291C5FEF51C7B031751DABFA602DD78AB5B5B6 | 5.230.70.60 | 200 OK | 9.3 kB |
URL GET HTTP/1.1bldllcs.net/adfs/portal/logo/logo.png?id=E1D28D47BC995ED3B42A20FCFB291C5FEF51C7B031751DABFA602DD78AB5B5B6 IP5.230.70.60:443
Requested byhttps://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typePNG image data, 260 x 75, 8-bit/color RGBA, non-interlaced Hashd8d52934d9dcc2b14224355694ec0d2c 46afe936cc634ff6e996c6e10f85265383cede9a e1d28d47bc995ed3b42a20fcfb291c5fef51c7b031751dabfa602dd78ab5b5b6
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /adfs/portal/logo/logo.png?id=E1D28D47BC995ED3B42A20FCFB291C5FEF51C7B031751DABFA602DD78AB5B5B6 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw==
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 9261
Content-Type: image/png
Expires: Thu, 06 Jun 2024 16:38:53 GMT
ETag: E1D28D47BC995ED3B42A20FCFB291C5FEF51C7B031751DABFA602DD78AB5B5B6
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 07 May 2024 16:38:53 GMT
Connection: close
|
|
| bldllcs.net/favicon.ico | 5.230.70.60 | 404 Not Found | 316 B |
IP5.230.70.60:443
Requested byhttps://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash9f8013f20649ac3cdc79f4e0650a27eb 15880987792299762d612df85034235ebb50c6a5 1f58102e34ac97921b416ae1cd88d811028ac44f784832cc85b20b0d07dd658d
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /favicon.ico HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw==
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Tue, 07 May 2024 16:38:53 GMT
Connection: close
content-length: 316
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| bldllcs.net/adfs/portal/illustration/illustration.jpg?id=06A27FA609CDEF984F2086590CAB840EDB36E2EBEE44692C61528FEA46472C75 | 5.230.70.60 | 200 OK | 202 kB |
URL GET HTTP/1.1bldllcs.net/adfs/portal/illustration/illustration.jpg?id=06A27FA609CDEF984F2086590CAB840EDB36E2EBEE44692C61528FEA46472C75 IP5.230.70.60:443
Requested byhttps://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw== CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
File typeJPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1420x1080, components 3 Size202 kB (202463 bytes) Hashda83148221dfb92123bac5711205b1d2 334312bbf6f31c5dcb88cc0bd54c060f2952a477 06a27fa609cdef984f2086590cab840edb36e2ebee44692c61528fea46472c75
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /adfs/portal/illustration/illustration.jpg?id=06A27FA609CDEF984F2086590CAB840EDB36E2EBEE44692C61528FEA46472C75 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw==
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag; buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 202463
Content-Type: image/jpeg
Expires: Thu, 06 Jun 2024 16:38:53 GMT
ETag: 06A27FA609CDEF984F2086590CAB840EDB36E2EBEE44692C61528FEA46472C75
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 07 May 2024 16:38:53 GMT
Connection: close
|
|
| bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZXZpbl9mbGFjaCU0MGFnaWxlbnQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTgzOTg2ZmQzLTY5M2MtYWQzNS0yYzYyLTg4ZDgzMGQwZmJmZiZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5NjcyODM2MjI4NDYuZjNiM2FhMGYtMGVhYS00MzFiLWE4NWEtMGU1N2U4MTc1YjcwJnN0YXRlPURZdExEc0l3REFVVE9Bc2JwTFJ1ZmpZTHhGR1FVeVZ0Ukpwc0tyZy1Yc3pUdk1Wb3BkUlZ1QWdhWkJSR1J3SGlJNklsRjYwbEg2ZmlrbU9HWWlBekctLVdaSmdDeXcyWWFjR1FFTFMwOTNuOGVINjFzZFgtM21zX241XzhGUzJOMV8zbWdiZmFjai1uZFJ4Xw== | 5.230.70.60 | 302 Found | 25 kB |
URL User Request GET HTTP/1.1bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZXZpbl9mbGFjaCU0MGFnaWxlbnQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTgzOTg2ZmQzLTY5M2MtYWQzNS0yYzYyLTg4ZDgzMGQwZmJmZiZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5NjcyODM2MjI4NDYuZjNiM2FhMGYtMGVhYS00MzFiLWE4NWEtMGU1N2U4MTc1YjcwJnN0YXRlPURZdExEc0l3REFVVE9Bc2JwTFJ1ZmpZTHhGR1FVeVZ0Ukpwc0tyZy1Yc3pUdk1Wb3BkUlZ1QWdhWkJSR1J3SGlJNklsRjYwbEg2ZmlrbU9HWWlBekctLVdaSmdDeXcyWWFjR1FFTFMwOTNuOGVINjFzZFgtM21zX241XzhGUzJOMV8zbWdiZmFjai1uZFJ4Xw== IP5.230.70.60:443
CertificateIssuerLet's Encrypt Subjectbldllcs.net Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1rZXZpbl9mbGFjaCU0MGFnaWxlbnQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTgzOTg2ZmQzLTY5M2MtYWQzNS0yYzYyLTg4ZDgzMGQwZmJmZiZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5NjcyODM2MjI4NDYuZjNiM2FhMGYtMGVhYS00MzFiLWE4NWEtMGU1N2U4MTc1YjcwJnN0YXRlPURZdExEc0l3REFVVE9Bc2JwTFJ1ZmpZTHhGR1FVeVZ0Ukpwc0tyZy1Yc3pUdk1Wb3BkUlZ1QWdhWkJSR1J3SGlJNklsRjYwbEg2ZmlrbU9HWWlBekctLVdaSmdDeXcyWWFjR1FFTFMwOTNuOGVINjFzZFgtM21zX241XzhGUzJOMV8zbWdiZmFjai1uZFJ4Xw== HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=vI3Fl1WxXZ4N; qPdM.sig=mSJrxpuZmoM1bPmggvhE7HEIIOc; ClientId=2767CD76749F41F1A10AE9BAF84C4F71; OIDC=1; OpenIdConnect.nonce.v3.8vWgwFyv2dZxtVM4R6CPwBL0I90uTinHwOwkI0AJUHs=638506967283622846.f3b3aa0f-0eaa-431b-a85a-0e57e8175b70; X-OWA-RedirectHistory=ArLym14BvmONK7Ru3Ag
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Location: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9lYWRmcy5hZ2lsZW50LmNvbS9hZGZzL2xzLz9sb2dpbl9oaW50PWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9ODM5ODZmZDMtNjkzYy1hZDM1LTJjNjItODhkODMwZDBmYmZmJnVzZXJuYW1lPWtldmluX2ZsYWNoJTQwYWdpbGVudC5jb20md2E9d3NpZ25pbjEuMCZ3dHJlYWxtPXVybiUzYWZlZGVyYXRpb24lM2FNaWNyb3NvZnRPbmxpbmUmd2N0eD1lc3RzcmVkaXJlY3QlM2QyJTI2ZXN0c3JlcXVlc3QlM2RyUVFJQVJBQWpaRlBhTk5nR01iN05WM2M1ci14aTBjaGVIRXp6YjgyVFl1Q2RWdlR6c3h0NmJvdEV3bGYwaVRMbXVRTFRiSnVHVDNwWVNESTlLVHU1bkV3RUNfS1RpTGlZYWZDUU1aZzZIRjRFUEUwOERCYnZIalQ1X0R3UFBEeUhuN1BDTWFrbWNJMS1vOVlzdWNrYlpvTXFSdTk5SmVhdzROREItajV3NXQyZHZlR3RubElkMzZkN1lDcnkySG9Cd1dLUWxIb0lOUklJOU8wZFNPdEk1ZENMVWk5QTZBRHdBa0F6NUpYR3NhcTdhbW1BX1hsMjlDeUhjTUxlM2M3eVJ6UENWbWF6X001VnVCNGxoVXlmTnJrTkE1QzJpUnBBMEl5d3pFYUNZVXM3TlpzemhDWVhGYkwwVWZKeTlQRktGeG1lNGFhZG16OFRBNllxT21xUGdyQ2w5Z1dHRmRDYVR5b3RNYUx0Ym5wWXFENWtoeVpLNHEwVmhKbmEtdnpvVHpwQjNlYkZya1l4SE9yVV9QSXI4dnpVZEdDUzNka1VXNlY3UXBmY1VvODdaUjUwMjY0MDZKaUYyT1JKQmVXSnEyeDlSYXJRRjJjblpDcWRKN3pCS1BNTTBGOWtlVGNRUFd5cWxDcXN2Y1lsWE10ellUNkN1blY1VFYxQl9zdjFtOHd2QXZHUmQ0LWhpUGY4T3g2SndXLXBzQzNWSkx1UDAyQlYzM2RNWTRQdHMtNDNTZlM0MC1QM241OGNUMngzMGRGOFZ5bE9oVVpNM0ZzQ1dKR01ibDFMUzlJOU5MWVJDMmFvYXA1ZDFTcExlaHd0S0xjNGdyTUZnNjJjSHdQSC1qSGhoSUVOamJEbk9EZ0J3NDJ6eVgyQnY2MWJPYzhPTHFRR2NSMUI5cHVNRHl5UWRoMU5VUU53eU1LRzhSYUY0S3U5OUlxZENJaklBcjNpZTVfNGtHNzNYNV9NWEY2NmN2VF9lTVBuN2VfbDE4UEpYNEQwIw==
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: ff9bd3dd-ad33-4c8e-8bc6-84b7c4992900
x-ms-ests-server: 2.1.18037.7 - SEC ProdSlices
x-ms-srs: 1.P
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: buid=0.AYIAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PbaSxzoekQEME6TaMy7lEmvHvLy4-JqVfAzyeATPbjBhAXM6G8v1AkXrvhYe89cfEU3bC8k5Dl_JZDcVBXAzgfkas_0PDhUI8ByB1HwDBJkgAA; expires=Thu, 06-Jun-2024 16:38:48 GMT; path=/; secure; HttpOnly; SameSite=None
fpc=AqwqLsvB9I1HgBZvh0w9-S2erOTJAQAAABhQzN0OAAAA; expires=Thu, 06-Jun-2024 16:38:49 GMT; path=/; secure; HttpOnly; SameSite=None
esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85F6t9HXzPUTBkGuf6fWxrqcj17AJwpm8hP6sbQ_my-hgmcckmmbmCQkwCfVWOzrxHHWyZgs6qerQ0f3CtwzvZfPTs5j06y2ZTOPBzjp6EyD005CjvzukYG1x3Wqhf1OAmakWTp2HJXxpPGAULYDsZN2uwRbm_rYJJF7Q4vo-KIggAA; domain=bldllcs.net; path=/; secure; HttpOnly; SameSite=None
cltm=CgAQABoAIgQIDBAF; domain=bldllcs.net; path=/; secure; HttpOnly; SameSite=None
x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Tue, 07 May 2024 16:38:48 GMT
Connection: close
content-length: 1664
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
0.0.0.0