| apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=https://discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t |  151.101.2.133 | | 0 B |
URL apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=https://discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t IP151.101.2.133:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click_tracker/track?kx_event_uid=LR25EaJr&clk=https://discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t HTTP/1.1
Host: apiservices.krxd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
location: https://discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t
age: 0
via: 1.1 varnish (Varnish/5.2), 1.1 varnish
accept-ranges: bytes
date: Thu, 01 Jun 2023 00:19:47 GMT
x-served-by: click-tracker-a006-ash-prod.krxd.net, cache-bma1672-BMA
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1685578787.461053,VS0,VE366
content-length: 0
X-Firefox-Spdy: h2
|
| discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t | 162.241.69.179 | | 0 B |
URL discountwhiskey.sa.com/new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t IP162.241.69.179:0 ASN#46606 UNIFIEDLAYER-AS-1
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /new/auth/sf_rand_string_lowercase6////eS5uZ3V5ZW5AbW9kZWMuY29t HTTP/1.1
Host: discountwhiskey.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 00:19:47 GMT
Server: Apache
refresh: 0;url=https://1tegu.filehosterus.com/My.nguyen@modec.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
| 1tegu.filehosterus.com/My.nguyen@modec.com |  0.0.0.0 | | 0 B |
URL User Request GET 1tegu.filehosterus.com/My.nguyen@modec.com IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /My.nguyen@modec.com HTTP/1.1
Host: 1tegu.filehosterus.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|