WEBSITE ANALYSIS REPORT

https://www.google.com/url?q=https%3A%2F%2Fnuseskincare.com%2Fjydsxz&sa=D&sntz=1&usg=AOvVaw0Ej4aFHZ3XyNMJ2KylWNFm#?aos=ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==

14 Jan 2026 · 00:38:17.000 UTCpublic

Report tags: phishing microsoft outlook
Submit tags

Request review

Phishing detected

3 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

00:37:55.833 GET 200 document 349 B 268 ms —

00:37:56.139 GET 301 document 11.6 KB 695 ms —

00:37:56.794 GET 302 document 11.6 KB 307 ms —

00:37:57.113 GET 200 document 11.6 KB 367 ms —

00:37:57.647 GET 200 script 19.5 KB 49 ms —

00:37:57.712 GET 200 img 16.6 KB 138 ms —

00:37:57.726 POST 204 xhr 0 B 4 ms —

00:38:04.567 POST 200 document 183.4 KB 1462 ms 1 alerts

00:38:06.044 POST 204 beacon 0 B 3 ms —

00:38:06.104 GET 200 stylesheet 111.5 KB 190 ms —

00:38:06.108 GET 200 script 453.2 KB 180 ms —

00:38:06.112 GET 200 script 60.2 KB 187 ms —

00:38:06.314 GET 200 script 185.7 KB 9 ms —

00:38:06.458 GET 200 script 397.9 KB 5 ms —

00:38:06.530 GET 404 subdocument 1.2 KB 414 ms —

00:38:06.679 POST 200 beacon 265 B 557 ms 1 alerts

00:38:06.687 GET 200 script 15.4 KB 10 ms —

00:38:06.690 GET 200 img 2.6 KB 12 ms —

00:38:06.691 GET 200 img 3.5 KB 8 ms —

00:38:06.770 GET 200 img 45.5 KB 3 ms —

00:38:06.851 GET 200 img 3.6 KB 2 ms —

00:38:06.870 GET 200 subdocument 17.7 KB 128 ms —

00:38:07.288 POST 200 xhr 265 B 463 ms 1 alerts

Transaction #08

Request / response

URL

POST HTTPS

https://divine-king-90ed.piqesiha.workers.dev/0x695bce6e8329cc1a0c021887/o/common/instrumentation/dssostatus

IP / ASN

172.67.179.131

AS13335 · CLOUDFLARENET

Requested by: https://divine-king-90ed.piqesiha.workers.dev/0x695bce6e8329cc1a0c021887/om/ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==

Resource information

File type: JSON text data
MIME type: application/json; charset=utf-8
First seen (UTC): 14 Jan 2026 · 00:38:42.491 UTC
Last seen (UTC): 14 Jan 2026 · 00:38:42.491 UTC
Times seen: 1

Size: 265 B (265 bytes)
MD5: 21d59974f18d746b48b8430271a3122a
SHA1: 9633b91022132ec23c8591c250c8783cb2aed223
SHA256: ae3dff6dd9e3726a587bb83c72d7cbf536991f166117352c460e922bb598b662

Certificate information

Issuer: Google Trust Services · WE1
Subject: piqesiha.workers.dev
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 05:B5:9C:A7:64:82:B9:DB:2E:16:0A:92:B1:6F:5F:58:AC:B0:86:70
Valid from: Mon, 12 Jan 2026 14:32:56 GMT
Valid until: Sun, 12 Apr 2026 15:31:15 GMT

Technology fingerprints

Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft Outlook	medium	Phishing

HTTP headers

Request headers

POST /0x695bce6e8329cc1a0c021887/o/common/instrumentation/dssostatus HTTP/1.1
Host: divine-king-90ed.piqesiha.workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
hpgid: 1104
hpgact: 2101
canary: PAQABDgEAAACvnsHKEvvRQb3Bz3Qc7wnaLIpGSDwlvnYnjyYE59EVHSxE3TTuDIiKDG8tYHxMasLSGt27gT5DbFuKJ4XPNLFVCgulB_HQ1nYSXMLibrFMxmXIy3KrNq9O5q07FldWfYftt5pkoIvYHZioO-B5P30Yb4hEfEOdXCFImdsU_z6Vfaaq18ZPOdHjryoCtP0cjsOM5KBG0Sagte0mgh2dw863l2lGX0I8XkFzO22v2sUGACAA
client-request-id: ed3d772d-3890-4a5d-b09d-11b9cbd4022d
hpgrequestid: 1ed0a597-e045-41db-aa4f-d1fa9cef3b00
Content-type: application/json; charset=utf-8
Content-Length: 207
Origin: https://divine-king-90ed.piqesiha.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://divine-king-90ed.piqesiha.workers.dev/0x695bce6e8329cc1a0c021887/om/ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==
Cookie: buid=1.ARoAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYBAAAaAA.AQABGgEAAACvnsHKEvvRQb3Bz3Qc7wnac86v_N1Pne9OFntcyi2fyKSla0H2Tdzj1oZ61U1GINHCAYk6sPrn0Czae-g3TnMNCp7OlC0ZoyWlyslDg_2zxTxsVqbo6LGvzrESi6k0lOkgAA; esctx=PAQABBwEAAACvnsHKEvvRQb3Bz3Qc7wna-4Q-A52N8Nd5UKXj812ReX2R00vks0gv6w5FgS4SnMJCMN6Jqk-WBKHt0GCDGkoDhkxLqbZz6fLOZWXnh8w5ziIiBkMpq8tD-_q-QztjzR0wECVsG5ZDFeuL0vo625S6xMgk1ErzVutaUExfx9zYXqL1R3fRJkLxIjSvRZNE88IgAA; esctx-j8xQS3oiqU4=AQABCQEAAACvnsHKEvvRQb3Bz3Qc7wnakwepLjn9475n8JoWGmIB04wofSs1A6setzO1yhAmqEYYaMc08trDuztmkLzjkeZMYbECdoauqSgb7OoxRJUTFdTbAIHB-4tjRWqgWzv6JgkpYLuE3qBnt7RvtI4epNfpmAh3SrggwJOQhvVgc322nCAA; fpc=AjHWj4RylLhBldSac0FE9JO4vjNwAQAAAGvc-OAOAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; appdfmd5naosiz309213=ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==; brcap=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 OK
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NGrl500j1ylhqu53w322V%2Fo7e6C0g%2FnM5jhoR3FBegaahR9JTkW%2FFhrvyp1ATpc9BQZ3PXvoE61ONJ60Mch0%2BJJMjEYB%2B7J6N7IKO4EYgLZGpdX4h7f4fi6R0tqz0uID1WK5D04%3D"}]}
priority: u=3,i=?0
date: Wed, 14 Jan 2026 00:38:07 GMT
content-type: application/json; charset=utf-8
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9bd911978e991525-OSL
cf-cache-status: DYNAMIC
access-control-allow-origin: https://divine-king-90ed.piqesiha.workers.dev
cache-control: no-cache,no-store, must-revalidate
content-encoding: gzip
expires: Mon, 25 Jul 1997 05:00:00 GMT
server: cloudflare
set-cookie: fpc=AjHWj4RylLhBldSac0FE9JO4vjNwAQAAAGvc-OAOAAAA; expires=Fri, 13-Feb-2026 00:38:07 GMT; path=/; secure; httponly; samesite=None
x-ms-gateway-slice=estsfd; path=/; secure; httponly; samesite=none
vary: Origin, accept-encoding, Origin
access-control-allow-credentials: true
access-control-allow-headers: Cookie, x-kpsdk-v, auth,authkey , authvalue, Authorization, User-Agent, Keep-Alive, Content-Type, X-Requested-With
access-control-allow-methods: GET, POST, DELETE, PUT, PATCH, OPTIONS
client-request-id: ed3d772d-3890-4a5d-b09d-11b9cbd4022d
x-ms-ests-server: 2.1.23173.3 - SCUS ProdSlices
x-ms-request-id: 5171f222-98b7-483b-a9db-d5451a6c2800
x-ms-srs: 1.P
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

Request body

Captured 207 B · Displayed 207 B

{"resultCode":101,"ssoDelay":0,"log":"Detected Browser: Firefox\nFrameListener: Frame returned code 101 with message IFrame: origin https://divine-king-90ed.piqesiha.workers.dev is not in the allowed list."}

00:38:07.295 GET 200 script 26.7 KB 4 ms —

00:38:07.691 GET 200 img 513 B 5 ms —

00:38:09.309 OPTIONS 200 xhr 0 B 1113 ms —

00:38:10.071 POST 200 xhr 153 B 939 ms —

https://www.google.com/url?q=https%3A%2F%2Fnuseskincare.com%2Fjydsxz&sa=D&sntz=1&usg=AOvVaw0Ej4aFHZ3XyNMJ2KylWNFm#?aos=ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==

Domain graph

Hostnames

Connections

Network requests

Transaction #08

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://www.google.com/url?q=https%3A%2F%2Fnuseskincare.com%2Fjydsxz&sa=D&sntz=1&usg=AOvVaw0Ej4aFHZ3XyNMJ2KylWNFm#?aos=ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #08

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

https://www.google.com/url?q=https%3A%2F%2Fnuseskincare.com%2Fjydsxz&sa=D&sntz=1&usg=AOvVaw0Ej4aFHZ3XyNMJ2KylWNFm#?aos=ZXJpbi53YXJkbGVAb3RzdWthLXVzLmNvbQ==

Domain graph

Network requests