| tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=//nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= |  34.241.96.184 | | 17 B |
URL tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=//nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= IP34.241.96.184:0
File typeASCII text, with no line terminators Hashedf537e37d4549950774190c58f93b76 4e2078632eccec8993f151be9338bbcb88ce6f58 afff9c63cfeacd26e5d4000edf576f1386d6729dca783eb45004f484a73a3514
GET /r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=//nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= HTTP/1.1
Host: tap-rt-prod1-t.campaign.adobe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Content-Type: text/plain; charset=utf-8
Date: Tue, 21 Nov 2023 06:45:25 GMT
Location: https:////nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE=
P3P: CP="CAO DSP COR CURa DEVa TAIa OUR BUS IND UNI COM NAV"
Server: Apache
Set-Cookie: AMCV_A7672BA85ECD64E10A495FF4%40AdobeOrg=MCMID%7C91510329678401372154322329742368833535; Domain=adobe.com; Path=/; Expires=Sun, 15-Dec-2024 06:45:25 GMT
nlid=9ecb88b|c1e96b3; Domain=adobe.com; Path=/
nllastdelid=c1e96b3; Domain=adobe.com; Path=/; Expires=Sun, 15-Dec-2024 06:45:25 GMT
X-Robots-Tag: noindex
Content-Length: 17
Connection: keep-alive
|
|
| nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= |  162.0.232.12 | | 0 B |
URL nazarenoexpress.com/hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= IP162.0.232.12:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /hhdhdhjbd/knpicss/terrjdjhfys/Y2F0aGFyaW5hLmFycGluQGZpYy5nb3YuemE= HTTP/1.1
Host: nazarenoexpress.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.2.34
refresh: 0;url=https://sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html#catharina.arpin@fic.gov.za
content-type: text/html; charset=UTF-8
content-length: 0
date: Tue, 21 Nov 2023 06:45:26 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html | 172.233.128.220 | | 236 B |
URL sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html IP172.233.128.220:0 ASN#20940 Akamai International B.V.
File typeXML 1.0 document text\012- XML document, ASCII text, with no line terminators Hashde947ed4e1b1eb39f60ba0c0545d2c33 219863b34429ea4b898caa6519125da6c054c5ad da1ebf68afac6a4bbe738321473b6f2241e1b6a67c6587395ff67e0429c5ac09
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /G762.html HTTP/1.1
Host: sharedfileoutlook366.us-lax-1.linodeobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Tue, 21 Nov 2023 06:45:28 GMT
Content-Type: application/xml
Content-Length: 236
Connection: keep-alive
x-amz-request-id: tx00000a49f10667b61e72d-00655c5208-32ad47e-default
Accept-Ranges: bytes
|
|
| GET sharedfileoutlook366.us-lax-1.linodeobjects.com/favicon.ico | 172.233.128.220 | 403 Forbidden | 236 B |
URL GET HTTP/1.1sharedfileoutlook366.us-lax-1.linodeobjects.com/favicon.ico IP172.233.128.220:443 ASN#20940 Akamai International B.V.
Requested byhttps://sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html#catharina.arpin@fic.gov.za CertificateIssuerLet's Encrypt Subjectus-lax-1.linodeobjects.com FingerprintDB:7B:C0:F2:7B:B6:04:57:64:07:62:5E:17:0B:0A:E0:F7:65:C0:22 ValidityMon, 30 Oct 2023 12:06:46 GMT - Sun, 28 Jan 2024 12:06:45 GMT
File typeXML 1.0 document text\012- XML document, ASCII text, with no line terminators Hashe1add5810be6e52ea9823c71b4845f51 69f573cbda90af658bfa56af089203335d8ab14f 701b98fd1dbb44a1f9b8265d558d42ed3879a1817e3c6796ffc0594b67c53347
GET /favicon.ico HTTP/1.1
Host: sharedfileoutlook366.us-lax-1.linodeobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Tue, 21 Nov 2023 06:45:28 GMT
Content-Type: application/xml
Content-Length: 236
Connection: keep-alive
x-amz-request-id: tx000002455b4f3dc5f9173-00655c5208-32883b6-default
Accept-Ranges: bytes
|
|
| GET sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html | 172.233.128.220 | 403 Forbidden | 236 B |
URL User Request GET HTTP/1.1sharedfileoutlook366.us-lax-1.linodeobjects.com/G762.html IP172.233.128.220:443 ASN#20940 Akamai International B.V.
CertificateIssuerLet's Encrypt Subjectus-lax-1.linodeobjects.com FingerprintDB:7B:C0:F2:7B:B6:04:57:64:07:62:5E:17:0B:0A:E0:F7:65:C0:22 ValidityMon, 30 Oct 2023 12:06:46 GMT - Sun, 28 Jan 2024 12:06:45 GMT
File typeXML document, ASCII text, with no line terminators Hashcdfb3fae85d70fe97c9b6460b486b0ab bc55bb64d7484e1f46825d829f0e6da869a6586b 38be4fcce3b2d3fe832da97dc2baed05ac3c107f036fa173b2f59dce8b33e0fb
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /G762.html HTTP/1.1
Host: sharedfileoutlook366.us-lax-1.linodeobjects.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Tue, 21 Nov 2023 06:45:28 GMT
Content-Type: application/xml
Content-Length: 236
Connection: keep-alive
x-amz-request-id: tx00000a49f10667b61e72d-00655c5208-32ad47e-default
Accept-Ranges: bytes
|
|