WEBSITE ANALYSIS REPORT

https://haticeceylan.com.tr/bish

12 Aug 2026 · 15:06:07.000 UTCpublic

Report tags: microsoft phishing outlook evilginx aitm
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

15:05:31.167 GET 301 document 0 B 421 ms —

15:05:31.598 GET 302 document 0 B 543 ms —

15:05:32.146 GET 200 document 34.1 KB 284 ms —

15:05:32.849 GET 200 stylesheet 11.7 KB 94 ms —

15:05:32.853 GET 200 stylesheet 2.6 KB 90 ms —

15:05:32.855 GET 200 script 2.9 KB 13 ms —

15:05:32.856 GET 200 script 189.3 KB 21 ms —

15:05:32.858 GET 200 script 296.4 KB 29 ms —

15:05:32.859 GET 200 script 50.1 KB 29 ms —

15:05:32.861 GET 200 script 27.7 KB 28 ms —

15:05:32.863 GET 200 script 89.5 KB 27 ms —

15:05:32.988 POST 200 beacon 0 B 0 ms —

15:05:32.991 GET 200 script 105.6 KB 13 ms —

15:05:32.992 GET 200 script 3.0 KB 12 ms —

15:05:33.016 GET 200 img 7.7 KB 396 ms —

15:05:33.018 GET 200 img 1.4 KB 13 ms —

15:05:33.020 GET 200 font 27.7 KB 61 ms —

15:05:33.021 GET 200 font 27.7 KB 64 ms —

15:05:34.911 POST No response beacon 0 B 0 ms —

15:05:34.926 POST 200 beacon 0 B 0 ms —

15:05:34.928 GET No response document 0 B 0 ms —

15:05:36.468 GET 200 document 24.7 KB 326 ms —

15:05:36.891 GET 200 script 0 B 0 ms —

15:05:39.626 GET 200 document 0 B 0 ms 1 alerts

15:05:45.449 GET 302 document 0 B 1021 ms 1 alerts

15:05:46.476 GET 302 document 0 B 1152 ms 1 alerts

15:05:47.635 GET 200 document 57.2 KB 1805 ms 3 alerts

15:05:49.447 GET 200 stylesheet 111.5 KB 1628 ms 1 alerts

15:05:49.448 GET 200 script 575.2 KB 2423 ms 1 alerts

15:05:49.449 GET 200 script 60.8 KB 1379 ms 1 alerts

15:05:49.451 GET 200 script 6.9 KB 521 ms 3 alerts

15:05:49.453 GET 200 script 0 B 837 ms 3 alerts

15:05:51.924 GET 200 script 185.7 KB 1931 ms 1 alerts

15:05:51.933 GET 200 script 116.8 KB 1030 ms 1 alerts

15:05:52.136 GET 200 img 16.8 KB 1103 ms 1 alerts

15:05:52.996 GET 200 script 11.7 KB 533 ms 1 alerts

15:05:53.538 GET 200 script 9.2 KB 537 ms 1 alerts

15:05:54.092 GET 200 script 398.6 KB 1577 ms 1 alerts

15:05:54.182 POST 200 xhr 293 B 590 ms 3 alerts

15:05:55.773 POST 200 beacon 293 B 1152 ms 3 alerts

15:05:55.776 GET 200 script 15.4 KB 1053 ms 1 alerts

15:05:55.779 GET 200 img 2.6 KB 1046 ms 1 alerts

15:05:55.781 GET 200 img 3.5 KB 1101 ms 1 alerts

Transaction #35

Request / response

URL

GET HTTPS

https://cdn-2.westfalenwind.sbs/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif

IP / ASN

18.142.249.243

AS16509 · AMAZON-02

Requested by: https://office.westfalenwind.sbs/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639221439471598274.NTQ1YTM1YmYtMDlmOC00NzBmLThhZDgtYTU4YWRmMmE0NWM1ZjQxMTkzYTMtZGQwZS00NTY2LWJmMDQtMGYwNjA1MmQwYzAw&ui_locales=en-US&mkt=en-US&client-request-id=2fd2f813-607f-4813-888b-2110fad593df&state=yTcwvFh8fG7GtjNiY4jjnLPPphrApGNNH2CIUbSw0uQ-FJaTH5yKEcsjBh7oUFSkre200awEvISUjjOfT5lxWSp5ZfOea0PKocRUVp2wSjX2rvUKWoEK6pb3V4znnA6bfvPLjcFbe51XO_-KvicKC82f7x_COQpPEWf7_2KjNg_6gASXhm83VTPSOeROTQJnQk_2rSI4ccAf9zrj-_x30FggQRX1tTtb6gO_0UTfeIxdDSzjK_rtowa5PeY9u6DJfefMTz_hhTnigLzaHD7M7irvzvBDoPK5eNl7vnPMiFClQ0Z3XIHwyxYHf5HWLQsVKDh_-X3whd8b9r4beb9nkW1LHzUZj_SmRHp0MrIk16bLyJleI9rYQ504UAnmO_DV83aXFF7x1KRIxAvUZY9qnF2GRHQqnk71Iava3hfYgMU&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Resource information

File type: GIF image data, version 89a, 352 x 3
MIME type: image/gif
First seen (UTC): 01 May 2023 · 12:40:43.000 UTC
Last seen (UTC): 20 Oct 2026 · 20:24:39.024 UTC
Times seen: 45949

Size: 3.5 KB (3620 bytes)
MD5: b540a8e518037192e32c4fe58bf2dbab
SHA1: 3047c1db97b86f6981e0ad2f96af40cdf43511af
SHA256: 8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Certificate information

Issuer: ZeroSSL GmbH · ZeroSSL ECC DV SSL CA 2
Subject: westfalenwind.sbs
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: DC:90:D7:BA:35:5A:38:FD:1E:BA:23:07:45:59:0B:A4:C0:FF:D8:1A
Valid from: Mon, 10 Aug 2026 00:00:00 GMT
Valid until: Sun, 08 Nov 2026 23:59:59 GMT

Technology fingerprints

Azure Front Door (Load balancers)
Azure (PaaS)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Evilginx MitM Proxy	high	Phishing

HTTP headers

Request headers

GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1
Host: cdn-2.westfalenwind.sbs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://office.westfalenwind.sbs/
Sec-GPC: 1
Connection: keep-alive
Cookie: b351-b254=5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Priority: u=5, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Cache-Control: public, max-age=31536000
Connection: close
Content-Type: image/gif
Date: Wed, 12 Aug 2026 15:05:56 GMT
Last-Modified: Wed, 24 May 2023 10:11:48 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Azure-Ref: 20260812T150556Z-1644cbf55f8rhvvhhC1SG1nrc4000000284g00000000317k
X-Cache: TCP_HIT
X-Fd-Int-Roxy-Purgeid: 0
X-Ms-Blob-Type: BlockBlob
X-Ms-Lease-Status: unlocked
X-Ms-Request-Id: 5ef4a5b6-801e-0028-43e4-22a2fe000000
X-Ms-Version: 2009-09-19

15:05:56.899 GET 200 img 45.5 KB 775 ms 1 alerts

15:05:56.901 GET 200 img 3.6 KB 523 ms 1 alerts

15:05:56.965 GET 200 subdocument 3.4 KB 1388 ms 1 alerts

15:05:56.992 POST 200 xhr 15 B 268 ms 3 alerts

15:05:58.757 GET 200 img 1.6 KB 551 ms 1 alerts

https://haticeceylan.com.tr/bish

Domain graph

Hostnames

Connections