urlquery.net
Investigate/Report/0143436c-d3ef-4ebe-8019-55cb30ed4a7c
WEBSITE ANALYSIS REPORT

https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

public
Report tags
phishing evilginx aitm microsoft reverse_proxy
Submit tags
Request review
Phishing detected

2 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

CallsLoads fromRedirects toEmbeds
Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds
Reset
Captured HTTP requests; click any summary row or use its hostname button to expand transaction details.
Timestamp (UTC)MethodStatusHost / pathTypeSizeDurationSignals
GET200document63.4 KB1409 ms2 alerts
GET200stylesheet111.5 KB1093 ms2 alerts
GET200script586.6 KB1470 ms2 alerts
GET200script68.5 KB1106 ms2 alerts
GET200script185.6 KB1288 ms2 alerts
GET200img16.8 KB731 ms2 alerts
GET200script399.3 KB1466 ms2 alerts
POST200beacon848 B800 ms2 alerts
GET200script15.4 KB733 ms2 alerts
GET200img2.6 KB733 ms2 alerts

Transaction #02

Request / response

URL

GET HTTPS
https://cdn-1.grootkoplogisticsbv.lol/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif

IP / ASN

Singapore 18.142.249.243

AS16509 · AMAZON-02

Requested by
https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Resource information

File type
GIF image data, version 89a, 352 x 3
MIME type
image/gif
First seen (UTC)
01 May 2023 · 12:40:43.000 UTC
Last seen (UTC)
21 Oct 2026 · 04:39:13.121 UTC
Times seen
45538
Size
2.6 KB (2672 bytes)
MD5
166de53471265253ab3a456defe6da23
SHA1
17c6df4d7ccf1fa2c9efd716fbae0fc2c71c8d6d
SHA256
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Certificate information

Issuer
ZeroSSL GmbH · ZeroSSL ECC DV SSL CA 2
Subject
grootkoplogisticsbv.lol
Protocol / cipher
TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint
0B:41:CF:EC:89:DA:AB:8D:D1:16:A3:9A:3F:14:4E:98:3A:B8:83:DC
Valid from
Sun, 11 Oct 2026 00:00:00 GMT
Valid until
Sat, 09 Jan 2027 23:59:59 GMT

Technology fingerprints

  • Apache HTTP Server (Web servers)

Detections

Detection observations attached to this HTTP transaction.
DetectionSeverityVerdict
urlquery Phishing - Evilginx MitM ProxyhighPhishing
urlquery Phishing - Microsoft Authentication Reverse ProxyhighPhishing

HTTP headers

Request headers

GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1
Host: cdn-1.grootkoplogisticsbv.lol
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://office.grootkoplogisticsbv.lol/
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Accept-Ranges,Cache-Control,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version
Akamai-Grn: 0.59ac3017.1791789346.8070d866
Cache-Control: public, max-age=108267
Connection: close
Content-Md5: Fm3lNHEmUlOrOkVt7+baIw==
Content-Type: image/gif
Date: Mon, 12 Oct 2026 07:15:46 GMT
Etag: "0x8DD14C029EBF349"
Last-Modified: Thu, 05 Dec 2024 00:02:52 GMT
Server: Apache
Transfer-Encoding: chunked
X-Ms-Request-Id: 4dd9d439-d01e-00bf-28a3-66fd89000000
X-Ms-Version: 2018-03-28
GET200img3.5 KB729 ms2 alerts
GET200img45.5 KB911 ms2 alerts
GET200img3.6 KB729 ms2 alerts
GET200subdocument3.4 KB1221 ms2 alerts
GET200img1.6 KB733 ms2 alerts
GET200img1.4 KB731 ms2 alerts
GET200img932 B731 ms2 alerts
POST200xhr25.3 KB1059 ms2 alerts
18 visible / 18 matching / 18 captured
First
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close
LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot