WEBSITE ANALYSIS REPORT

https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

12 Oct 2026 · 07:16:20.000 UTCpublic

Report tags: phishing evilginx aitm microsoft reverse_proxy
Submit tags

Request review

Phishing detected

2 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

07:15:39.782 GET 200 document 63.4 KB 1409 ms 2 alerts

Transaction #04

Request / response

URL

GET HTTPS

https://office.grootkoplogisticsbv.lol/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

IP / ASN

18.142.249.243

AS16509 · AMAZON-02

Requested by: Not recorded

Resource information

File type: HTML document, Unicode text, UTF-8 text, with very long lines (46470), with CRLF, LF line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 12 Oct 2026 · 07:16:32.614 UTC
Last seen (UTC): 12 Oct 2026 · 07:16:32.614 UTC
Times seen: 1

Size: 63.4 KB (64904 bytes)
MD5: ea41c4e7a1d61c0955c2182e3cbdf217
SHA1: 4c452096374b447ca7652547fb53dea4804734f9
SHA256: 6b63136992a19df27579435263d7412ad15eecc297850b581ea8534d22cdf93f

Certificate information

Issuer: ZeroSSL GmbH · ZeroSSL ECC DV SSL CA 2
Subject: grootkoplogisticsbv.lol
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 0B:41:CF:EC:89:DA:AB:8D:D1:16:A3:9A:3F:14:4E:98:3A:B8:83:DC
Valid from: Sun, 11 Oct 2026 00:00:00 GMT
Valid until: Sat, 09 Jan 2027 23:59:59 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Evilginx MitM Proxy	high	Phishing
urlquery Phishing - Microsoft Authentication Reverse Proxy	high	Phishing

HTTP headers

Request headers

GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639273845398022467.NmMyYjNmZDktYjU5ZC00ZGZhLTkwM2ItMmE4NTFlNTk5YzNkMzAwNDI4MzUtNGZjMS00MDdmLTlhYWEtYzc5NDM1MTcyMDU3&ui_locales=de&mkt=de&client-request-id=e1e2a79b-cb14-4c7c-ae56-46549112183b&siwa=1&siwg=1&state=duXnPO_CloJgOmzGs-SBRP7ceygdLzP36Mi6CFp5101b-7D9TOZzAr5gulAt-foMCNfDIV8OB_NI8tpz8-RmIK8kl-8299xYLctHFpPF4dstBp3GIBKLgM2gHgBt6wrEIZpQCfj8j2bEFiGupEjhvbpxaLxk_UJNzAdVKKStdVODxmC3ocD3ga8_O2CpovHQ4Nm3RTvM6enZEjsNjV4E2b72p0Jbvs6OJEkQKY_vKNOSlMKEQesYbcz8LAVuEE0yUDQhkwjiQAZfhFlZqO3qSOu9rvccLK-t8HDqEGFFm_K05zo4bTQA0PnphAWi3gyMG1UkSjaiFNPt-OUJaehvZmRadQNVi4ZlGVVsqyE5MZLkX2gkPxXxodM7IyA4gQdTX0-UNFzlSsawMPVvhNycsvy2XLJnLSKlIrQo2TvxNxyhzMGB_jk7DCd47NNQsgti&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0 HTTP/1.1
Host: office.grootkoplogisticsbv.lol
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Connection: close
Content-Type: text/html; charset=utf-8
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"
Date: Mon, 12 Oct 2026 07:15:39 GMT
Expires: -1
Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Reporting-Endpoints: coop-endpoint="https://coop.msauth.net:443/api/coopReport?client_type=web-msal&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&correlation_id=e1e2a79b-cb14-4c7c-ae56-46549112183b&sku=IdNet&version=8.16.0&is1p=1"
Server: nginx
Set-Cookie: buid=1.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoAAAAKAA.BgABGgEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzAwAAAAAAj6hokWuWrYVsWhPrU-5HR6HhvXo7EbR06e5ZC03wehhyZ2n_8GnWFnCFiK0CT_2Ryp7mrHN93r4vRH5L34-G4hdh1BJmWLXnar5txy6XSuAxfT1_7i1331ZYXwI8t6U3-1BwERL1KFlEJq78mUVwqXq-grExlDU_dRbDVWJvh4z7U9F18CuijTtzIeVnDtVuIM0ChDspnG1-4ec0FrPh8ZBRzPQZ30lA0McAIu6KrGPjqPrzNwUvNgLdNcr0hPPtHTjyApKEas39mDPtQexexhN0cKpYGwLIWOVvS8MwwTdmTch0DKt1oIa4M5GtJD00S5lA0hQDq7tgdFywwZBKTb2mmIOtSlpsR8bmyWtn4unjtL2304u2MxOmO2YSSAICOBAWQEwfi3n9OhOKTaZxJFz-06TTQjFuhfXGTKUC9R7zN-IYVwALAEZat-uMoI7rnu-9fCUb20xtj1jA-CTS2nMakrbezbJnn4mAMW0uOJibFBMy6FO8f7sq7ylg7dublsEeIjEKYZAUZ1TWjpEYZSdOKPZVfwbKwDVsAVrThyuPNXRflk8bS6FGKtkr4nfmerb3paisA2YBZNisiptHHELRHDRyUwzY1iY7TXtwpUEl2WXTH7tEhA2WWqykDIQrkynTWPIrRmqCnib4BdfXLxhvwccnwkU6gdcB7o2ZWWkgAA; Path=/; Expires=Wed, 11 Nov 2026 07:15:40 GMT; HttpOnly; Secure; SameSite=None
esctx=PBgABBwEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzDQAAAAAAeBpI0q-s1PvTT6_HiivI0tcSp7zUezKSYescl7xZlFn_fAj1TvWl3ekwPlOBl_YNa-W5rKrpm7NJP1p7vgimaXp71BP4-hR_F5upQCwwfcaqKgmx-DTUx9uNsthC7G3ULQj1YZT_CspFcRwUcSY-UzaLOcNb1af-OW6raY5ymJrl7x7FqHZQHpek-SqKhhwuWR6TfxSDl-lFBcaftPK5R0JNch_HLgymZI-QD7WKx7cwb5LUo9Ge98-dFHLU13SVR-72Jd2JQkFOXv9cwcxt15fdXdtCY6pYeBDYHg6v4Ph9QbbcOYK6btOn-VGDDetytfczpL058Q1d8rBjqOLf1W8c-xEK5_ZdQqabbj7Qtm5_QkPKRTav0xZ634eUYKgbkIYqaSH2kKqDsu_HH2gS-jlNk6yb7MSC1GSftsYU75wbBpbT1_BJKocGZybvaPkVkJaiDm6C9oVWILXXwfbzG2WcENleUoo_foIrwo5JNeMX1L_h8BpkKgWTrx5O5L7JSd8c5fYdKWn9MqasNtoBnmkoDkvsc2QR7WleDTHKollRSml4_1GLdZx6cbe7ib0G4rw2asB09POWlRuhxWIqU2EtWniVFMDPUESnObfYHaaerwFkxMfjjY0h6_klF4DxdL_1B-1ranBIgKDK692GzBvEdQXOKIH5qqtgZNA4lIMYP4r8rv26wjDEtDPlD-yyovL2Ava6wC7yKdZ-0oRY6OuS1pthFI2mA10vwwXcgxogAA; Path=/; Domain=office.grootkoplogisticsbv.lol; HttpOnly; Secure; SameSite=None
esctx-qzUvGE9BvgU=AQABCQEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzDQAAAAAAfTBtsqk2C4f9IeNmuVRrLy0MYZzpolcGBeFdZut6qR65RKV93CYUo_9p8eGOhAzO5iF-l6Pklz_eeakMtrE-uuf5e8sWsEc5o-Fit06oDupKl_uYPecJE7jthAqfWAFUA8MkUeTSY04l7in-OrXuSSAA; Path=/; Domain=office.grootkoplogisticsbv.lol; HttpOnly; Secure; SameSite=None
fpc=AiLR2SlR1uhFg_qdYKMX0c68Ae7AAQAAABuAXuIOAAAA; Path=/; Expires=Wed, 11 Nov 2026 07:15:40 GMT; HttpOnly; Secure; SameSite=None
x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
stsservicecookie=estsfd; Path=/; HttpOnly; Secure; SameSite=None
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Dns-Prefetch-Control: on
X-Ms-Clitelem: 1,50058,0,,
X-Ms-Ests-Server: 2.1.25338.5 - KRSLR1 ProdSlices
X-Ms-Request-Id: d347c44c-edbd-45c5-8bf2-2ad683462a00
X-Ms-Srs: 1.P

07:15:41.228 GET 200 stylesheet 111.5 KB 1093 ms 2 alerts

07:15:41.231 GET 200 script 586.6 KB 1470 ms 2 alerts

07:15:41.235 GET 200 script 68.5 KB 1106 ms 2 alerts

07:15:42.782 GET 200 script 185.6 KB 1288 ms 2 alerts

07:15:42.902 GET 200 img 16.8 KB 731 ms 2 alerts

07:15:44.133 GET 200 script 399.3 KB 1466 ms 2 alerts

07:15:45.704 POST 200 beacon 848 B 800 ms 2 alerts

07:15:45.709 GET 200 script 15.4 KB 733 ms 2 alerts

07:15:45.712 GET 200 img 2.6 KB 733 ms 2 alerts

07:15:45.714 GET 200 img 3.5 KB 729 ms 2 alerts

07:15:46.499 GET 200 img 45.5 KB 911 ms 2 alerts

07:15:46.500 GET 200 img 3.6 KB 729 ms 2 alerts

07:15:46.521 GET 200 subdocument 3.4 KB 1221 ms 2 alerts

07:15:48.109 GET 200 img 1.6 KB 733 ms 2 alerts

07:15:48.114 GET 200 img 1.4 KB 731 ms 2 alerts

07:15:48.116 GET 200 img 932 B 731 ms 2 alerts

07:15:49.883 POST 200 xhr 25.3 KB 1059 ms 2 alerts

Domain graph

Hostnames

Connections

Network requests

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Domain graph

Network requests