WEBSITE ANALYSIS REPORT

https://haticeceylan.com.tr/bish

12 Aug 2026 · 15:06:07.000 UTCpublic

Report tags: microsoft phishing outlook evilginx aitm
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

15:05:31.167 GET 301 document 0 B 421 ms —

15:05:31.598 GET 302 document 0 B 543 ms —

15:05:32.146 GET 200 document 34.1 KB 284 ms —

15:05:32.849 GET 200 stylesheet 11.7 KB 94 ms —

15:05:32.853 GET 200 stylesheet 2.6 KB 90 ms —

15:05:32.855 GET 200 script 2.9 KB 13 ms —

15:05:32.856 GET 200 script 189.3 KB 21 ms —

15:05:32.858 GET 200 script 296.4 KB 29 ms —

15:05:32.859 GET 200 script 50.1 KB 29 ms —

15:05:32.861 GET 200 script 27.7 KB 28 ms —

15:05:32.863 GET 200 script 89.5 KB 27 ms —

15:05:32.988 POST 200 beacon 0 B 0 ms —

15:05:32.991 GET 200 script 105.6 KB 13 ms —

15:05:32.992 GET 200 script 3.0 KB 12 ms —

15:05:33.016 GET 200 img 7.7 KB 396 ms —

15:05:33.018 GET 200 img 1.4 KB 13 ms —

15:05:33.020 GET 200 font 27.7 KB 61 ms —

15:05:33.021 GET 200 font 27.7 KB 64 ms —

15:05:34.911 POST No response beacon 0 B 0 ms —

15:05:34.926 POST 200 beacon 0 B 0 ms —

15:05:34.928 GET No response document 0 B 0 ms —

15:05:36.468 GET 200 document 24.7 KB 326 ms —

15:05:36.891 GET 200 script 0 B 0 ms —

15:05:39.626 GET 200 document 0 B 0 ms 1 alerts

15:05:45.449 GET 302 document 0 B 1021 ms 1 alerts

15:05:46.476 GET 302 document 0 B 1152 ms 1 alerts

15:05:47.635 GET 200 document 57.2 KB 1805 ms 3 alerts

15:05:49.447 GET 200 stylesheet 111.5 KB 1628 ms 1 alerts

15:05:49.448 GET 200 script 575.2 KB 2423 ms 1 alerts

15:05:49.449 GET 200 script 60.8 KB 1379 ms 1 alerts

15:05:49.451 GET 200 script 6.9 KB 521 ms 3 alerts

15:05:49.453 GET 200 script 0 B 837 ms 3 alerts

15:05:51.924 GET 200 script 185.7 KB 1931 ms 1 alerts

15:05:51.933 GET 200 script 116.8 KB 1030 ms 1 alerts

15:05:52.136 GET 200 img 16.8 KB 1103 ms 1 alerts

15:05:52.996 GET 200 script 11.7 KB 533 ms 1 alerts

15:05:53.538 GET 200 script 9.2 KB 537 ms 1 alerts

15:05:54.092 GET 200 script 398.6 KB 1577 ms 1 alerts

15:05:54.182 POST 200 xhr 293 B 590 ms 3 alerts

Transaction #04

Request / response

URL

POST HTTPS

https://office.westfalenwind.sbs/common/handlers/watson

IP / ASN

18.142.249.243

AS16509 · AMAZON-02

Requested by: https://office.westfalenwind.sbs/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639221439471598274.NTQ1YTM1YmYtMDlmOC00NzBmLThhZDgtYTU4YWRmMmE0NWM1ZjQxMTkzYTMtZGQwZS00NTY2LWJmMDQtMGYwNjA1MmQwYzAw&ui_locales=en-US&mkt=en-US&client-request-id=2fd2f813-607f-4813-888b-2110fad593df&state=yTcwvFh8fG7GtjNiY4jjnLPPphrApGNNH2CIUbSw0uQ-FJaTH5yKEcsjBh7oUFSkre200awEvISUjjOfT5lxWSp5ZfOea0PKocRUVp2wSjX2rvUKWoEK6pb3V4znnA6bfvPLjcFbe51XO_-KvicKC82f7x_COQpPEWf7_2KjNg_6gASXhm83VTPSOeROTQJnQk_2rSI4ccAf9zrj-_x30FggQRX1tTtb6gO_0UTfeIxdDSzjK_rtowa5PeY9u6DJfefMTz_hhTnigLzaHD7M7irvzvBDoPK5eNl7vnPMiFClQ0Z3XIHwyxYHf5HWLQsVKDh_-X3whd8b9r4beb9nkW1LHzUZj_SmRHp0MrIk16bLyJleI9rYQ504UAnmO_DV83aXFF7x1KRIxAvUZY9qnF2GRHQqnk71Iava3hfYgMU&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Resource information

File type: JSON text data
MIME type: application/json; charset=utf-8
First seen (UTC): 12 Aug 2026 · 15:06:19.467 UTC
Last seen (UTC): 12 Aug 2026 · 15:06:19.467 UTC
Times seen: 1

Size: 293 B (293 bytes)
MD5: ff69d985570d5375418282a5d78e8f5c
SHA1: 2df7f0aa12330c9e30481e17908970404d8b6a36
SHA256: 08d74c862982ea8648055a0f2a0be56a38cbb782ba02f77c800f3fea6d1847b5

Certificate information

Issuer: ZeroSSL GmbH · ZeroSSL ECC DV SSL CA 2
Subject: westfalenwind.sbs
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: DC:90:D7:BA:35:5A:38:FD:1E:BA:23:07:45:59:0B:A4:C0:FF:D8:1A
Valid from: Mon, 10 Aug 2026 00:00:00 GMT
Valid until: Sun, 08 Nov 2026 23:59:59 GMT

Technology fingerprints

Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft	medium	Phishing
urlquery Phishing - Microsoft Outlook	medium	Phishing
urlquery Phishing - Evilginx MitM Proxy	high	Phishing

HTTP headers

Request headers

POST /common/handlers/watson HTTP/1.1
Host: office.westfalenwind.sbs
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://office.westfalenwind.sbs/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639221439471598274.NTQ1YTM1YmYtMDlmOC00NzBmLThhZDgtYTU4YWRmMmE0NWM1ZjQxMTkzYTMtZGQwZS00NTY2LWJmMDQtMGYwNjA1MmQwYzAw&ui_locales=en-US&mkt=en-US&client-request-id=2fd2f813-607f-4813-888b-2110fad593df&state=yTcwvFh8fG7GtjNiY4jjnLPPphrApGNNH2CIUbSw0uQ-FJaTH5yKEcsjBh7oUFSkre200awEvISUjjOfT5lxWSp5ZfOea0PKocRUVp2wSjX2rvUKWoEK6pb3V4znnA6bfvPLjcFbe51XO_-KvicKC82f7x_COQpPEWf7_2KjNg_6gASXhm83VTPSOeROTQJnQk_2rSI4ccAf9zrj-_x30FggQRX1tTtb6gO_0UTfeIxdDSzjK_rtowa5PeY9u6DJfefMTz_hhTnigLzaHD7M7irvzvBDoPK5eNl7vnPMiFClQ0Z3XIHwyxYHf5HWLQsVKDh_-X3whd8b9r4beb9nkW1LHzUZj_SmRHp0MrIk16bLyJleI9rYQ504UAnmO_DV83aXFF7x1KRIxAvUZY9qnF2GRHQqnk71Iava3hfYgMU&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0
Content-Type: application/json; charset=utf-8
canary: PAQABDgEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzCAAAAAAAHVPiNCrgUfITrP7_1E15_0S6tfYyXbcBjcN9g4_11rzpcGpuFbqxsxrTnoa7iw8pHvG41Uti6MrTJbHLGrrG-D5C0tLJJMvFX9qDZOpcL4cEChCx_NHSKc_igwtZEK08pBvX0SP1l9yPcZIirqWXEMY1yYKW9zpBDbUBzvD-iYwiPDg-LI0LXmwNKu1PGGGaIbSq8y5ZIhflikhzxX-rcSAA
hpgid: 1104
hpgact: 1800
client-request-id: 2fd2f813-607f-4813-888b-2110fad593df
X-Requested-With: XMLHttpRequest
Content-Length: 4838
Origin: https://office.westfalenwind.sbs
Sec-GPC: 1
Connection: keep-alive
Cookie: b351-b254=5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e; buid=1.AT0AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoAAAA9AA.AQABGgEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAwAAAAAAAnfR5MRDVHQZ8lJ2IvPdHe7UCgBim4n3k8CcQiVRKrYsqfKcCG1WpERIUueXiiiRRJ8j9iyK-b_36bTZLSwyipP9-CPBUUtyOTdEcQp0wJcgAA; esctx=PBgABBwEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzDQAAAAAA1IDY1LEwuOH9M5q1Q8MCjnax0ZRgSnIjRknTtX_o1Sv-J8mYcufatNrOaUxoPsgj17rrBaJ2LRVhszX4LisGBf-ehSVWAn6Q2_m_YGPd1Aot2Ga6cFjCQO_I4LzoddBYyx-wNepFGplFUFKrE7bTtWmnaWZS1VNNzgAf6IrUpnDQkRwEkIyJlP9YZxijEOfIUxbS0hD1HJ5Tk3PjZk9O5UnCeyfkME_KVpWkK-XroawPsWrEZwIt75_zSak0zo_0ExQLsgvuCxavkoco0_laNt0_trq9twhx9Q021irfnEBKzca-V8N6rfjTO6vFhCWx1ekzUg09SqoRLSA0m-P0alcq8HQXArSBmWkR_pku2rrYIL_3JdoW-76r94tuuNWV1DGzj2lnd2MP8t-25ZIPcNS0cRnl-5AzKR1103ZyfDkHUmV5_geUyRtoFCVB1KMzkQZqFy6o-D1ewF3UHEP020NhTTVyIA2u5pQ6XjJW2EPOMmj7QGWB1uPhto9Z31wqEhH74Ulsxq4WCGuH0P2fF54K3FzNWS7wLewt0PSSouaFa29wVE19CpyvffaIe-CjVxslNmDBEkOFZ-2KrxKHgNhcnWFe-gHKGLPU3A-yt3DDY2dZJWRklHm-FxZCfpSJFJpsyXd0Xxicm58cNx3VU7aJVsIf6S0p5KY9u7Egbp673-Ttw8g1bq8y6LZNEutymOVVdoTHmZpZdOGCKsHYevFKWk-5eKVHVP4NhZPiM-IgAA; esctx-QlHtmUfh4Og=AQABCQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzDQAAAAAAVMvq8q3ZY-TKUi5-1B0a8j7ppcgCFco11qJEKOBoPcInCdlJCrAS_wOgCzqojpP7XW21ERQWaFrzFygYy3c7jVW38KatCOB5dvWMekR1Hz06dtLgi1brFmUr6Nl9hTleZoR3NnZh4Q6x9EvzQp15diAA; fpc=AoO-jj0Oo0VEvyLda5EYUh-8Ae7AAQAAAMyCDuIOAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; brcap=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Client-Request-Id: 2fd2f813-607f-4813-888b-2110fad593df
Connection: close
Content-Type: application/json; charset=utf-8
Date: Wed, 12 Aug 2026 15:05:53 GMT
Expires: -1
P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx
Set-Cookie: fpc=AoO-jj0Oo0VEvyLda5EYUh-8Ae7AAQAAAMyCDuIOAAAA; Path=/; Expires=Fri, 11 Sep 2026 15:05:54 GMT; HttpOnly; Secure; SameSite=None
x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
Transfer-Encoding: chunked
X-Ms-Ests-Server: 2.1.25074.15 - KRC ProdSlices
X-Ms-Request-Id: c6afddd0-8345-40eb-bee3-76006d6e2b00
X-Ms-Srs: 1.P

Request body

Captured 4.7 KB · Displayed 4.0 KB

{"ec":"SyntaxError:SyntaxError: unexpected token: identifier","wec":"34","idx":1,"pn":"ConvergedSignIn","sc":1013,"hpg":1104,"msg":"SyntaxError: unexpected token: identifier","url":"https://office.westfalenwind.sbs/s/5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e/c7e12b28c09ea25f66d62d8af792b6aa60e1d1eb18fd8d5e0b6db7bf245280f1.js","ln":1,"ad":2271,"an":false,"cs":"","sd":{"slc":"ProdSlices","dc":"JPE","ri":"TYOXXXX","ver":{"v":[2,1,25074,15]},"rt":"2026-08-12T15:05:48","et":16,"axv":"4.380.134"},"drb":false,"ls":[{"type":"text/javascript","content":"//<![CDATA[ $Config={\"fShowPersistentCookiesWarning\":false,\"urlMsaSign..."},{"type":"text/javascript","content":"//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug||{},t=e.$Conf..."},{"type":"text/javascript","content":"//<![CDATA[ !function(e,t){function r(t){return function(){t.parentNod..."},{"type":"text/javascript","content":"ServerData = $Config;"},{"crossorigin":"anonymous","src":"https://cdn-2.westfalenwind.sbs/shared/1.0/content/js/ConvergedLogin_PCore_JKW0L16A9pVVqOU3BI29xA2.js"},{"src":"https://cdn-2.westfalenwind.sbs/shared/1.0/content/js/oneDs_36c085e9e54fe9d23a54.js"},{"crossorigin":"anonymous","src":"https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lzfw9ovraljpmqc6m13khq2.js"},{"type":"text/javascript","src":"https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js","id":"WebWatson_DemandSupport","crossorigin":"anonymous"},{"type":"text/javascript","src":"https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js","id":"WebWatson_DemandFramework","crossorigin":"anonymous"},{"type":"text/javascript","src":"https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/watson.min_82o5oyf7tvyeotpacdeksw2.js","id":"WebWatson_DemandLoaded","crossorigin":"anonymous"},{"src":"https://cdn-2.westfalenwind.sbs/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8b85641b040053cb2c94.js"},{"type":"text/javascript","content":"//<![CDATA[ !function(){var e=window,o=e.document,i=e.$Config||{};if(e..."},{"type":"application/javascript","src":"/s/5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e/c7e12b28c09ea25f66d62d8af792b6aa60e1d1eb18fd8d5e0b6db7bf245280f1.js"},{"type":"application/javascript","src":"/s/5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e.js"},{"content":"(function() { var sessionId = '5c3bb908d9eae7aaa73eac3abece3510c6132c5..."}],"diag":["jQuery v:3.5.1","jQuery.easing:{\"_default\":\"swing\",\"def\":\"easeOutQuad\"}","Expected jQuery v:3.5.1","$Do.o[$WebWatson;doc.ready;jQuery;jQuery.version;jQuery.ready;$Api;doc.load;$WebWatson.full;]","$Do.q[]","0:Wed, 12 Aug 2026 15:05:51 GMT:[$Loader]: Loaded 'https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/converged.v2.login.min_pzfy2abhlubh6bv_dyvwha2.css', id:, async:, defer:","1:Wed, 12 Aug 2026 15:05:51 GMT:[$Loader]: Loaded 'https://cdn-2.westfalenwind.sbs/shared/1.0/content/js/ConvergedLogin_PCore_JKW0L16A9pVVqOU3BI29xA2.js', id:, async:, defer:","2:Wed, 12 Aug 2026 15:05:51 GMT:[$Loader]: Loaded 'https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lzfw9ovraljpmqc6m13khq2.js', id:, async:, defer:","3:Wed, 12 Aug 2026 15:05:51 GMT:[WebWatson]:SyntaxError: unexpected token: identifier in https://office.westfalenwind.sbs/s/5c3bb908d9eae7aaa73eac3abece3510c6132c59f954445def09579005974d5e/c7e12b28c09ea25f66d62d8af792b6aa60e1d1eb18fd8d5e0b6db7bf245280f1.js @ 1","4:Wed, 12 Aug 2026 15:05:51 GMT:[$Loader]: Loading 'https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js', id:WebWatson_DemandSupport","5:Wed, 12 Aug 2026 15:05:52 GMT:[$Loader]: Loaded 'https://cdn-2.westfalenwind.sbs/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js', id:WebWatson_DemandSupport, async:, defer:","6:Wed, 12 Aug 2026 15:05:52 GMT:[$Loader]: Loading 'https://cdn-2.westfal

15:05:55.773 POST 200 beacon 293 B 1152 ms 3 alerts

15:05:55.776 GET 200 script 15.4 KB 1053 ms 1 alerts

15:05:55.779 GET 200 img 2.6 KB 1046 ms 1 alerts

15:05:55.781 GET 200 img 3.5 KB 1101 ms 1 alerts

15:05:56.899 GET 200 img 45.5 KB 775 ms 1 alerts

15:05:56.901 GET 200 img 3.6 KB 523 ms 1 alerts

15:05:56.965 GET 200 subdocument 3.4 KB 1388 ms 1 alerts

15:05:56.992 POST 200 xhr 15 B 268 ms 3 alerts

15:05:58.757 GET 200 img 1.6 KB 551 ms 1 alerts

https://haticeceylan.com.tr/bish

Domain graph

Hostnames

Connections

Network requests

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://haticeceylan.com.tr/bish

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #04

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

https://haticeceylan.com.tr/bish

Domain graph

Network requests