urlquery Phishing - Evilginx MitM Proxy
VerdictPhishing
Severityhigh
WEBSITE ANALYSIS REPORT
https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0
public
Phishing detected
Review evidence →2 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0
- Submitted IP / ASN
18.142.249.243 AS16509 · Amazon.com, Inc.
- Final URL
- https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0
- Final IP / ASN
- 18.142.249.243 AS16509 · AMAZON-02
Final page
- Page title
- Bei Ihrem Konto anmelden
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 106.1 KB (108655 bytes)
Detections
Activity
- HTTP requests
- 18
- Observed hosts
- 3
- Script records
- 180
Estimated HTTP data
- Sent
- ~17.4 KB
- Received
- ~1.51 MB
Page capture
Final browser state
office.grootkoplogisticsbv.lol
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Microsoft Authentication Reverse Proxy
VerdictPhishing
Severityhigh
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| cdn-1.grootkoplogisticsbv.lol 28 alerts | N/A | 2026-10-11 | 2026-10-12 | 2026-10-12 | 7.9 KB | 1.42 MB | 18.142.249.243 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Apache HTTP Server Web servers Apache is a free and open-source cross-platform web server software. Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| office.grootkoplogisticsbv.lol 6 alerts | N/A | 2026-10-11 | 2026-10-12 | 2026-10-12 | 8.7 KB | 94.6 KB | 18.142.249.243 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| ebqprupn.grootkoplogisticsbv.lol 2 alerts | N/A | N/A | N/A | N/A | 561 B | 4.1 KB | 18.142.249.243 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |