Report - axonsoftware.co.za/zook/hook/sf_rand_string_lowercase6/ZHNmZW5rZWxAdWRlbC5lZHU=

Report Overview

Visited public
2023-08-16 21:41:10
Tags
phishing microsoft outlook
URL
axonsoftware.co.za/zook/hook/sf_rand_string_lowercase6/ZHNmZW5rZWxAdWRlbC5lZHU=
Finishing URL
phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu
IP / ASN
192.185.88.195
#46606 UNIFIEDLAYER-AS-1
Title
Loading...
Phishing - Microsoft Outlook

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
axonsoftware.co.za	unknown	2022-03-09	2022-03-09 12:54:00	2023-08-16 22:57:57	535 B	224 B	192.185.88.195
phhd94yyee64459f0563812.youthf.ru	unknown	2023-05-08	2023-05-22 17:49:05	2023-08-16 22:57:57	1.7 kB	21 kB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu	ScriptElement	6.0 kB	2024-08-21	2024-08-21
Pretty URL phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-21 08:34 Last Seen2024-08-21 08:34 Times Seen1 Hash 2faf6022e51a5786e5196889211523c4 b4e4c1f2ed85010b547cecdd09464906d2727f03 29f8be2cef6ddb081b1ef60d295501e694f13057e49661e0469dfeb7fbb097d6 Loading...

HTTP Transactions (4)

URL IP Response Size

axonsoftware.co.za/zook/hook/sf_rand_string_lowercase6/ZHNmZW5rZWxAdWRlbC5lZHU=

192.185.88.195

200 OK

0 B

URL User Request GET HTTP/2
axonsoftware.co.za/zook/hook/sf_rand_string_lowercase6/ZHNmZW5rZWxAdWRlbC5lZHU=
IP
192.185.88.195:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectmail.axonsoftware.co.za
FingerprintE6:B4:00:1D:46:C3:90:9F:DE:68:48:F9:0B:3F:E3:A6:BE:D8:BC:82
ValidityWed, 12 Jul 2023 15:14:20 GMT - Tue, 10 Oct 2023 15:14:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /zook/hook/sf_rand_string_lowercase6/ZHNmZW5rZWxAdWRlbC5lZHU= HTTP/1.1
Host: axonsoftware.co.za
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
refresh: 0;url=https://phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 16 Aug 2023 21:40:53 GMT
server: Apache
X-Firefox-Spdy: h2

phhd94yyee64459f0563812.youthf.ru/favicon.ico

188.114.96.1

403 Forbidden

5.9 kB

URL GET HTTP/3
phhd94yyee64459f0563812.youthf.ru/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu
Certificate
IssuerLet's Encrypt
Subjectyouthf.ru
Fingerprint2E:C6:1E:52:BA:4B:7A:B6:7C:22:D2:D9:05:13:6B:AD:E2:86:68:46
ValidityWed, 12 Jul 2023 21:38:43 GMT - Tue, 10 Oct 2023 21:38:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6027), with no line terminators
Size
5.9 kB (5942 bytes)
Hash
8493e82e6a9e38789fa3380394cbb88a
9ba2256776d740d428b3e9970c3a8ca6ba25aad6
a747327848244811fadcd1412d78dc1e2b1d3178d88a63c1a9355f8e7bbed7c6

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: phhd94yyee64459f0563812.youthf.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu?__cf_chl_rt_tk=scZ._V9fVWPpgW0GypSY_zkT9b5VQPiHtXSGb04btqM-1692222053-0-gaNycGzNDdA
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 403 Forbidden
date: Wed, 16 Aug 2023 21:40:53 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FQimn7KJl2c3MXtb9oBUGttT1lkcRNI81KH%2BcrUPGgZPx8PfBVN9ZDRmYxVDYqN3Rjk7IsoJkTfoku2D%2F7k5zdYt6TDF4il7Nv3jlhT1tgPmLuTtTZjZlvJDPq5E0xkIKWnDKZa7n3FNueaIwnxDfZegYAs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f7cd69d0f4f1c0e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu

188.114.96.1

403 Forbidden

6.9 kB

URL User Request GET HTTP/2
phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectyouthf.ru
Fingerprint2E:C6:1E:52:BA:4B:7A:B6:7C:22:D2:D9:05:13:6B:AD:E2:86:68:46
ValidityWed, 12 Jul 2023 21:38:43 GMT - Tue, 10 Oct 2023 21:38:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (6995), with no line terminators
Size
6.9 kB (6910 bytes)
Hash
7841ac86208f0cc1225c9023fbc42ac6
98d12d680d0ccd61d3778d746d5ca6718f4f5c21
c6f065bcf434b17ccd892137bf448416833cc0060bd53acf984ae90dfb5342f9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /Mdsfenkel@udel.edu HTTP/1.1
Host: phhd94yyee64459f0563812.youthf.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Wed, 16 Aug 2023 21:40:53 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RkTG18wZIT53vMc3%2BCPx0JGN4Ww3Dfo5oElNCLerFYTsU18ZdCOuzpObAi8lCaEsNoIMScL4K7kdx6o8nFa7qLLrRkpYMATunVIcUy7vIZ7RkAm%2BZlX9NUteOvsCioV6H5EkdHkC5yiG0HeSNo7p1F2iZF4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f7cd69bea0cb4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

phhd94yyee64459f0563812.youthf.ru/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f7cd69bea0cb4ed

188.114.96.1

200 OK

4.8 kB

URL GET HTTP/3
phhd94yyee64459f0563812.youthf.ru/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f7cd69bea0cb4ed
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu
Certificate
IssuerLet's Encrypt
Subjectyouthf.ru
Fingerprint2E:C6:1E:52:BA:4B:7A:B6:7C:22:D2:D9:05:13:6B:AD:E2:86:68:46
ValidityWed, 12 Jul 2023 21:38:43 GMT - Tue, 10 Oct 2023 21:38:42 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5035), with no line terminators
Size
4.8 kB (4798 bytes)
Hash
47e1b44b72dddfdf14705c2dc86396c1
a23640e98ba44c56c964b08a71086c2cd8a57874
008e546f0600d8ece55928dd1c97194b046b2d1285ac0aac2684ea4ec9d4127b

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f7cd69bea0cb4ed HTTP/1.1
Host: phhd94yyee64459f0563812.youthf.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://phhd94yyee64459f0563812.youthf.ru/Mdsfenkel@udel.edu?__cf_chl_rt_tk=scZ._V9fVWPpgW0GypSY_zkT9b5VQPiHtXSGb04btqM-1692222053-0-gaNycGzNDdA
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 16 Aug 2023 21:40:53 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4kx6wbJdMnLqnigNCi6VJuDIwhZSvbM9uXq3wvaqFYLtXxqrlHQ73FvEBqzzGlmGXn4C8K2DGeH0IkFROJms%2BnrhM%2Bc23w9hyCnuvjohbHLbVz22K7NIHDzXD6lDoWqolMZOLMN1Xva4snPgn2rSlVMUSb4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f7cd69cdf211c0e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (4)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers