Report - frosty-glitter-422d.ar7252.workers.dev/

Report Overview

Visited public
2024-01-02 04:15:40
Tags
microsoft phishing
URL
frosty-glitter-422d.ar7252.workers.dev/
Finishing URL
frosty-glitter-422d.ar7252.workers.dev/
IP / ASN
104.21.56.102
#13335 CLOUDFLARENET
Title
Sign in to your Microsoft account
Phishing - Microsoft

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
smtpjs.com	309535	2016-01-30	2016-02-01 17:59:05	2024-01-01 14:20:35	430 B	1.2 kB	109.169.71.112
api.ipify.org	3267	2014-01-05	2014-10-06 14:38:43	2024-01-01 18:12:51	455 B	205 B	104.237.62.212
frosty-glitter-422d.ar7252.workers.dev	unknown	unknown	No data	No data	507 B	110 kB	172.67.183.196
aadcdn.msauth.net	1421	2018-10-25	2018-11-19 11:50:03	2024-01-01 05:17:48	2.6 kB	24 kB	13.107.213.53
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2024-01-01 13:16:34	444 B	31 kB	151.101.130.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-01-02 04:15:12	low	Client IP	Internal IP	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2024-01-02 04:15:12	low	Client IP	Internal IP	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2024-01-02 04:15:12	low	Client IP	104.237.62.212	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-01-01	medium	frosty-glitter-422d.ar7252.workers.dev/	Outlook

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	frosty-glitter-422d.ar7252.workers.dev/	229 B	2023-03-07 12:05	2024-08-21 05:03
Pretty URL frosty-glitter-422d.ar7252.workers.dev/ IP 172.67.183.196 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 05:03 Times Seen31 Hash 96fe34d40cb750121988496b19b57cf3 9131c2c5d40d2994545e1d7a1a85e8c0fd1b3b44 4034c24e8cf11422b9b7d24fdc6b6eb8d21ef2664f08c10524056340b541805b Loading...

	code.jquery.com/jquery-3.1.1.min.js	87 kB	2023-03-07 01:02	2024-12-29 00:30
Pretty URL code.jquery.com/jquery-3.1.1.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-12-29 00:30 Times Seen103841 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	frosty-glitter-422d.ar7252.workers.dev/	3.1 kB	2024-01-02 05:15	2024-08-20 14:20
Pretty URL frosty-glitter-422d.ar7252.workers.dev/ IP 172.67.183.196 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-01-02 05:15 Last Seen2024-08-20 14:20 Times Seen4 Hash c4e5615e9815cefd0ea34a48d833d288 75afb13fde19e1e6f972c134015753bab2f0ceef 4fa9a018096f7af1b00160a91b6d8bb9ed3777454fd4b7980f586ff37a01e935 Loading...

	frosty-glitter-422d.ar7252.workers.dev/	264 B	2023-03-07 12:05	2024-08-21 05:03
Pretty URL frosty-glitter-422d.ar7252.workers.dev/ IP 172.67.183.196 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 05:03 Times Seen31 Hash ac77ace9ab64f97271e8b6b07387a4bb 015cde12d66f8838bb8f09d10727a568bc669da7 71d2faf80f8dda66e64585125e96fef364aab9604d856a82e9de28e0fd2a8395 Loading...

	api.ipify.org/?format=jsonp&callback=getPublic	33 B	2023-03-07 01:24	2024-10-06 09:21
Pretty URL api.ipify.org/?format=jsonp&callback=getPublic IP 104.237.62.212 ASN #18450 WEBNX Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24 Last Seen2024-10-06 09:21 Times Seen1521 Hash b1fdb43145cf7c3f6f2a1370889232f1 19cd287ba1ffae5908cf8d53d13abc302dac6f9c 9a751b74811a7c42413bc5109600706395ac8a8c057f7e6a55fc45b7ea41b191 Loading...

	smtpjs.com/v3/smtp.js	868 B	2023-03-07 01:06	2024-12-10 13:42
Pretty URL smtpjs.com/v3/smtp.js IP 109.169.71.112 ASN #20860 Iomart Cloud Services Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06 Last Seen2024-12-10 13:42 Times Seen1842 Hash 73572da03234fa6d561c64b59c152230 5de5efc900b7eaf2b93b02f7c4c260fa938ef983 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776 Loading...

	frosty-glitter-422d.ar7252.workers.dev/	0 B	0001-01-01 00:00	2024-12-29 00:56
Pretty URL frosty-glitter-422d.ar7252.workers.dev/ IP 172.67.183.196 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2024-12-29 00:56 Times Seen3646428 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (9)

URL IP Response Size

aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png

13.107.213.53

200 OK

1.1 kB

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Size
1.1 kB (1057 bytes)
Hash
ed9c9eb0dce17d752bedea6b5acda6d9
eca56c4904354eed5da0debcd6bd66856ab4784d
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

HTTP Headers

GET /ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=604800
content-length: 1057
content-type: image/png
content-md5: 7ZyesNzhfXUr7eprWs2m2Q==
last-modified: Fri, 02 Nov 2018 20:25:31 GMT
etag: 0x8D641015620C409
x-cache: TCP_HIT
x-ms-request-id: 6aef3535-e01e-000d-2ba6-39e868000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0KJqNZQAAAAAQt6JhJ/a0Q5vjn3p0P+9VQU1TMDRFREdFMTgxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 00o2TZQAAAADwgHvSdyciRaH/Qnd8Qv+gU1ZHMjBFREdFMDYwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 02 Jan 2024 04:15:14 GMT
X-Firefox-Spdy: h2

aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png

13.107.213.53

200 OK

240 B

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Size
240 B (240 bytes)
Hash
7cc096da6aa2dba3f81fcc1c8262157c
a50776316f0220ed7cd7882a68c742a8861c999d
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

HTTP Headers

GET /ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=604800
content-length: 240
content-type: image/png
content-md5: fMCW2mqi26P4H8wcgmIVfA==
last-modified: Fri, 02 Nov 2018 20:25:10 GMT
etag: 0x8D64101494D74DC
x-cache: TCP_HIT
x-ms-request-id: de7f24a7-f01e-0050-50a6-395440000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0KJqNZQAAAADdkzA6WQ11Tp7txdprlZP3QU1TMDRFREdFMTkwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 00o2TZQAAAAAGE91DxNpHQ6GSAIa3G3ZkU1ZHMjBFREdFMDYwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 02 Jan 2024 04:15:14 GMT
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.1.1.min.js

151.101.130.137

200 OK

30 kB

URL GET HTTP/2
code.jquery.com/jquery-3.1.1.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (32030)
Size
30 kB (30070 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /jquery-3.1.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-152b5"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 02 Jan 2024 04:15:15 GMT
age: 9368314
x-served-by: cache-lga21947-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 118, 280488
x-timer: S1704168915.030822,VS0,VE0
vary: Accept-Encoding
content-length: 30070
X-Firefox-Spdy: h2

smtpjs.com/v3/smtp.js

109.169.71.112

200 OK

871 B

URL GET HTTP/2
smtpjs.com/v3/smtp.js
IP
109.169.71.112:443
ASN
#20860 Iomart Cloud Services Limited

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerLet's Encrypt
Subjectsmtpjs.com
Fingerprint87:59:78:52:A1:99:19:97:C4:08:CD:84:CB:5A:CC:BD:49:89:97:DF
ValidityMon, 11 Dec 2023 02:19:14 GMT - Sun, 10 Mar 2024 02:19:13 GMT

File type
Unicode text, UTF-8 (with BOM) text, with very long lines (841), with CRLF line terminators
Size
871 B (871 bytes)
Hash
3834e1b9e65ca954b7479464ea1e5118
437df45dbf59c3a3414236f44e3bcd5045bfe314
fc33c6b2c79aafa930e841962ae3c25bf8f56cbc20ec48fc2b0ddd0aa6ee23b6

HTTP Headers

GET /v3/smtp.js HTTP/1.1
Host: smtpjs.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript
last-modified: Tue, 10 Nov 2020 17:17:51 GMT
accept-ranges: bytes
etag: "162f436b85b7d61:0"
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
access-control-allow-origin: *
date: Tue, 02 Jan 2024 04:15:14 GMT
content-length: 871
X-Firefox-Spdy: h2

api.ipify.org/?format=jsonp&callback=getPublic

104.237.62.212

200 OK

33 B

URL GET HTTP/1.1
api.ipify.org/?format=jsonp&callback=getPublic
IP
104.237.62.212:443
ASN
#18450 WEBNX

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerSectigo Limited
Subject*.ipify.org
FingerprintF4:76:2D:2C:65:D1:15:BE:19:A4:C5:E0:8D:EB:89:1A:B6:75:4A:54
ValidityTue, 07 Feb 2023 00:00:00 GMT - Sun, 18 Feb 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
33 B (33 bytes)
Hash
b1fdb43145cf7c3f6f2a1370889232f1
19cd287ba1ffae5908cf8d53d13abc302dac6f9c
9a751b74811a7c42413bc5109600706395ac8a8c057f7e6a55fc45b7ea41b191

HTTP Headers

GET /?format=jsonp&callback=getPublic HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.25.2
Date: Tue, 02 Jan 2024 04:15:15 GMT
Content-Type: application/javascript
Content-Length: 33
Connection: keep-alive
Vary: Origin

aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png

13.107.213.53

200 OK

207 B

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT

File type
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Size
207 B (207 bytes)
Hash
0ad43084800fd8b50a2576b5173746fe
97c08e6062ff37f6e7a6c65e94d693ccc9ccd443
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

HTTP Headers

GET /ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
content-length: 207
content-type: image/png
content-md5: CtQwhIAP2LUKJXa1FzdG/g==
last-modified: Fri, 02 Nov 2018 20:25:24 GMT
etag: 0x8D6410151EBB082
x-cache: TCP_MISS
x-ms-request-id: 47b2dcbc-201e-0045-3e32-3d6368000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0042TZQAAAADD+Y2gUZgHTIvZQuBpp+w1QU1TMDRFREdFMTgxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 00o2TZQAAAAD4YMaQnbXRR4+6DgOFG4c1U1ZHMjBFREdFMDYwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 02 Jan 2024 04:15:15 GMT
X-Firefox-Spdy: h2

aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg

13.107.213.53

200 OK

673 B

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
673 B (673 bytes)
Hash
bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

HTTP Headers

GET /ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 673
content-type: image/svg+xml
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
last-modified: Thu, 13 Feb 2020 02:05:12 GMT
etag: 0x8D7B0292911C366
x-cache: TCP_MISS
x-ms-request-id: 31ee9a36-501e-0076-0932-3d3f7f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0042TZQAAAABdni6+WuFrS4NQLQ3PyU5jQU1TMDRFREdFMTgxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 00o2TZQAAAAAAuMZNlu5AQ4BbbedoSvVtU1ZHMjBFREdFMDYwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 02 Jan 2024 04:15:15 GMT
X-Firefox-Spdy: h2

aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico

13.107.213.53

200 OK

17 kB

URL GET HTTP/2
aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://frosty-glitter-422d.ar7252.workers.dev/
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint88:95:0C:FA:9D:33:AA:BF:A4:FD:9D:84:A6:E8:02:06:58:50:AD:8C
ValiditySun, 29 Oct 2023 00:00:00 GMT - Tue, 29 Oct 2024 23:59:59 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

HTTP Headers

GET /ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://frosty-glitter-422d.ar7252.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
cache-control: public, max-age=604800
content-length: 17174
content-type: image/x-icon
content-md5: EuPayFgGHQiAI7K9SOL6lg==
last-modified: Fri, 02 Nov 2018 20:25:25 GMT
etag: 0x8D6410152A9D7E1
x-cache: TCP_HIT
x-ms-request-id: c34f27c1-801e-0027-5628-3d774e000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0l42TZQAAAACgukndDzvjT4oFH3v+d7nFQU1TMDRFREdFMTgwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0042TZQAAAABRRmXd+iEZTZ32+31xtk3KU1ZHMjBFREdFMDYwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 02 Jan 2024 04:15:15 GMT
X-Firefox-Spdy: h2

frosty-glitter-422d.ar7252.workers.dev/

172.67.183.196

200 OK

110 kB

URL User Request GET HTTP/2
frosty-glitter-422d.ar7252.workers.dev/
IP
172.67.183.196:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectar7252.workers.dev
Fingerprint40:B0:34:BC:D0:74:E9:28:CE:12:E4:3F:20:D3:FC:8A:18:53:9B:0A
ValidityFri, 15 Dec 2023 01:10:33 GMT - Thu, 14 Mar 2024 01:10:32 GMT

File type
HTML document, ASCII text, with very long lines (64829)
Size
110 kB (109634 bytes)
Hash
1875742557e32fbce2a8e85ccc25795d
2db6f98687bbaff7fd7dc23e720dddb066cb3d78
3500b52798f4d4292b7f149bce520686e851d289723eb5689e5e5183642918d1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft
OpenPhish	phishing	Outlook

HTTP Headers

GET / HTTP/1.1
Host: frosty-glitter-422d.ar7252.workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 02 Jan 2024 04:15:14 GMT
content-type: text/html
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sFdBAoIOYJr2JF2%2BYVdlCu76rrkIdipGXvxKbIfcaKq77Bf9UeN4ScG5x%2BCEV%2F5gsdPdhuehmyUEMVRQZd7v8zbF%2FgMD4Ot3qITmiSQmrLwN%2BLnKE6schROgJ37ZSeHPvSQfYHGO4Rqg1pg7BY4HCBdTzROhsWdeMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83f02e037e5f5699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (9)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash