WEBSITE ANALYSIS REPORT

https://sites.google.com/view/stern-bau-co-at/home

21 Jul 2026 · 07:52:37.000 UTCpublic

Report tags: microsoft phishing evilginx aitm
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

administrator-api.prozri.info1 captured requests
apis.google.com2 captured requests
cdn-2.prozri.info15 captured requests
code.jquery.com1 captured requests
csi.gstatic.com2 captured requests
csp.withgoogle.com1 captured requests
events.prozri.info1 captured requests
fonts.googleapis.com3 captured requests
fonts.gstatic.com6 captured requests
online-appppdevoppoioiesese.prozri.info8 captured requests
play.google.com4 captured requests
sites.google.com4 captured requests
ssl.gstatic.com1 captured requests
ssolive.prozri.info1 captured requests
substack.com1 captured requests
www.gstatic.com10 captured requests
www.iltecnico.info4 captured requests
www.prozri.info1 captured requests

Connections

administrator-api.prozri.info → online-appppdevoppoioiesese.prozri.infoRedirects to1 captured connections
online-appppdevoppoioiesese.prozri.info → cdn-2.prozri.infoLoads from15 captured connections
online-appppdevoppoioiesese.prozri.info → events.prozri.infoCalls1 captured connections
online-appppdevoppoioiesese.prozri.info → ssolive.prozri.infoEmbeds1 captured connections
online-appppdevoppoioiesese.prozri.info → www.prozri.infoRedirects to1 captured connections
sites.google.com → apis.google.comLoads from2 captured connections
sites.google.com → csi.gstatic.comLoads from2 captured connections
sites.google.com → csp.withgoogle.comCalls1 captured connections
sites.google.com → fonts.googleapis.comLoads from3 captured connections
sites.google.com → fonts.gstatic.comLoads from6 captured connections
sites.google.com → play.google.comCalls4 captured connections
sites.google.com → ssl.gstatic.comLoads from1 captured connections
sites.google.com → substack.comRedirects to1 captured connections
sites.google.com → www.gstatic.comLoads from10 captured connections
sites.google.com → www.iltecnico.infoRedirects to1 captured connections
substack.com → www.iltecnico.infoRedirects to1 captured connections
www.iltecnico.info → administrator-api.prozri.infoRedirects to1 captured connections
www.iltecnico.info → code.jquery.comLoads from1 captured connections
www.iltecnico.info → online-appppdevoppoioiesese.prozri.infoRedirects to2 captured connections
www.iltecnico.info → www.prozri.infoRedirects to1 captured connections
www.prozri.info → online-appppdevoppoioiesese.prozri.infoRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

07:52:03.462 GET 200 document 107.3 KB 283 ms —

07:52:04.243 GET 200 stylesheet 4.8 KB 85 ms —

07:52:04.246 GET 200 stylesheet 48.3 KB 315 ms —

07:52:04.247 GET 200 stylesheet 21.9 KB 312 ms —

07:52:04.249 GET 200 stylesheet 1.47 MB 122 ms —

07:52:04.251 GET 200 script 14.2 KB 83 ms —

07:52:04.253 GET 200 script 504.8 KB 346 ms —

07:52:04.260 GET 200 img 4.7 KB 148 ms —

07:52:04.261 POST 204 beacon 0 B 0 ms —

07:52:04.573 GET 200 script 318.5 KB 46 ms —

07:52:04.611 GET 200 img 290.1 KB 125 ms —

07:52:04.624 GET 200 font 22.7 KB 102 ms —

07:52:04.625 GET 200 font 22.5 KB 90 ms —

07:52:04.628 GET 200 font 23.0 KB 89 ms —

07:52:04.629 GET 200 font 33.4 KB 84 ms —

07:52:04.631 GET 200 font 42.1 KB 97 ms —

07:52:04.635 GET 200 font 42.1 KB 94 ms —

07:52:04.756 GET 200 script 40.9 KB 17 ms —

07:52:04.759 GET 200 script 852 B 17 ms —

07:52:04.780 GET 200 script 375.8 KB 24 ms —

07:52:04.808 GET 200 img 1.1 KB 17 ms —

07:52:04.818 POST 200 xhr 16 B 184 ms —

07:52:04.856 GET 204 img 0 B 0 ms —

07:52:04.858 GET 204 img 0 B 0 ms —

07:52:04.911 GET 200 script 125.4 KB 18 ms —

07:52:04.939 GET 200 script 31.4 KB 17 ms —

07:52:04.940 GET 200 script 34.9 KB 17 ms —

07:52:04.948 POST 200 fetch 131 B 44 ms —

07:52:04.952 OPTIONS 200 fetch 0 B 74 ms —

07:52:05.018 GET 200 script 75.0 KB 18 ms —

07:52:07.817 POST 200 xhr 16 B 157 ms —

07:52:07.820 POST 200 fetch 131 B 34 ms —

07:52:07.822 OPTIONS 200 fetch 0 B 29 ms —

07:52:08.459 GET 302 document 0 B 181 ms —

07:52:08.645 GET 200 document 15.2 KB 172 ms 1 alerts

07:52:08.930 GET 200 script 85.5 KB 64 ms —

07:52:08.937 GET 200 img 256.7 KB 38 ms 1 alerts

07:52:08.939 GET 200 img 131.1 KB 36 ms 1 alerts

07:52:09.044 GET 404 img 146 B 106 ms 1 alerts

07:52:19.287 GET 302 document 0 B 150 ms 1 alerts

07:52:19.444 GET 302 document 0 B 163 ms 2 alerts

07:52:19.613 GET 302 document 0 B 244 ms 1 alerts

07:52:19.855 GET 200 document 60.7 KB 267 ms 2 alerts

07:52:20.282 GET 200 stylesheet 111.5 KB 268 ms 1 alerts

07:52:20.284 GET 200 script 575.1 KB 564 ms 1 alerts

07:52:20.285 GET 200 script 60.5 KB 303 ms 1 alerts

07:52:20.287 GET 200 script 1.2 KB 123 ms 2 alerts

07:52:20.912 GET 200 script 185.7 KB 321 ms 1 alerts

07:52:20.928 GET 200 script 116.8 KB 274 ms 1 alerts

Transaction #14

Request / response

URL

GET HTTPS

https://cdn-2.prozri.info/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

IP / ASN

104.21.19.131

AS13335 · CLOUDFLARENET

Requested by: https://online-appppdevoppoioiesese.prozri.info/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639202171397683855.MzdmMzlhMGUtZGM5NS00OWY3LTgzYWQtYTMwOThlM2MxYjJlYWZkOTVjMjYtMjcyZS00N2U5LWEwYTItNGM4ZDFmMzRiOGVi&ui_locales=en-US&mkt=en-US&client-request-id=453f54a2-4fc9-43d9-a7c4-97e32b727f6f&state=neAPouTZU98iYx-BHgBq3sQdmgIE18AXXt1X_vJjnu5OemkI-SGDUE73etY2oPnVa8E7hXgnz-98_ir4hojWw73GGP_-aCN6k3-nzd7BAvxxfOSq4pxs3bdYyTEkUN1xMjynCSmCcLeg7wQrmGlXSqgyPgB1u55Ixs0laj1ocslTflkhZht9P1w_M0c1Vx6woJfsgeNx0rcTzBdhv9uV5drOLknkisjs_s8jo9htE1Dxt9F-2XcuWstHLblego8R08D4aiC-ZPR6K8DL3_O1O0z5SPLeGkUaXG4ry6MS7yxrl8btWfGtFsx8RYT9hkmO9JpiMtuVy61NyKLrau1lvndX9vZm_hTN96aW2K2-kPzubzPbH1Oom1liLY8a_ScsZqLg9g8-vbP_EablRcvnqyGrXMrXxHOXWZHzKL9r1GE&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0

Resource information

File type: JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators
MIME type: application/x-javascript
First seen (UTC): 08 Mar 2023 · 03:03:54.000 UTC
Last seen (UTC): 18 Oct 2026 · 03:33:47.921 UTC
Times seen: 15927

Size: 116.8 KB (119648 bytes)
MD5: 75cf78d0e38c65a538ad253ca9e48dbe
SHA1: bf0452e4a42a9af3b69d5d8c3a3a0433f14921b6
SHA256: df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Certificate information

Issuer: Google Trust Services · WE1
Subject: prozri.info
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: D3:65:B2:97:99:1F:3C:C6:B1:AC:A8:1F:DF:38:27:E1:AE:73:B4:27
Valid from: Tue, 26 May 2026 05:06:01 GMT
Valid until: Mon, 24 Aug 2026 06:05:21 GMT

Technology fingerprints

Azure Front Door (Load balancers)
Azure (PaaS)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Evilginx MitM Proxy	high	Phishing

HTTP headers

Request headers

GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1
Host: cdn-2.prozri.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://online-appppdevoppoioiesese.prozri.info/
Origin: https://online-appppdevoppoioiesese.prozri.info
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
content-encoding: zstd
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
priority: u=3,i=?0
content-type: application/x-javascript
date: Tue, 21 Jul 2026 07:52:21 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
last-modified: Fri, 26 Feb 2021 06:13:13 GMT
server: cloudflare
x-azure-ref: 20260721T075221Z-1577759f5dbc7j8shC1AMSgs680000000rug00000000rbbv
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 0627878d-a01e-0062-336d-140171000000
x-ms-version: 2009-09-19
cf-cache-status: MISS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tjdXfPbTd8IJctZtGy8bz7jLuG0Ev7sk8AvCQaod8iotkGUh0akRkK%2FMzs2TLuOfGWBHIH2ZfJKyn8apl0knVFv9wf8mtena5KVv3Fvo66AXSYjZdtEAT5qdveXQuFK4kjv4Jw%3D%3D"}]}
cf-ray: a1e8a02acaa2568d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

07:52:20.948 GET 302 script 0 B 5 ms 2 alerts

https://sites.google.com/view/stern-bau-co-at/home