go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature&af_web_dp=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature
143.204.55.129 0 B URL go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature&af_web_dp=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature
IP 143.204.55.129:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature&af_web_dp=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature HTTP/1.1
Host: go.onelink.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
content-type: application/octet-stream
content-length: 0
date: Thu, 15 Feb 2024 15:56:09 GMT
location: //714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=//714443diYOVX2T477564.bonma.ch/.1ow./373429qYu6GXTp345847/Y2NlbmRlamFzQHNvYm9iYS5jb20=?pid=InProduct&pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
cache-control: no-cache, no-store
server: http-kit
x-cache: Miss from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: hikBu0oaWL7z45PhThWNH_2IvUFqNGkcNZcaf-TvHxjfKDgbVA0JDQ==
X-Firefox-Spdy: h2
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
216.58.207.234200 OK 31 kB URL GET HTTP/2 ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP 216.58.207.234:443
Requested by https://login.bonma.ch/.owa./#ccendejas@soboba.com
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint6F:81:CD:1A:A2:80:8C:76:2C:D8:63:D0:74:1B:DD:35:C8:79:84:20
ValidityTue, 09 Jan 2024 06:30:50 GMT - Tue, 02 Apr 2024 06:30:49 GMT
File type JavaScript source, ASCII text, with very long lines (65451)
Hash 220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://login.bonma.ch/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 15 Feb 2024 03:46:35 GMT
expires: Fri, 14 Feb 2025 03:46:35 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 43775
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/segoeui-semilight.ttf
52.136.245.70200 OK 26 kB URL GET HTTP/1.1 webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/segoeui-semilight.ttf
IP 52.136.245.70:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://login.bonma.ch/.owa./#ccendejas@soboba.com
Certificate IssuerDigiCert Inc
Subjectsmtp.addaxpetroleum.com
Fingerprint63:F4:03:E9:26:C2:9F:F0:C4:7B:F2:A3:D4:26:75:B1:F8:B2:F1:89
ValidityWed, 31 May 2023 00:00:00 GMT - Sun, 30 Jun 2024 23:59:59 GMT
File type TrueType Font data, 16 tables, 1st "OS/2", 11 names, Microsoft, language 0x409, � 2010 Microsoft Corporation. All Rights Reserved.RegularSegoe UI SemilightVersion 1.00 build 16
Hash 6c26c24aabe31040657665b1e0d9505c
b3bdc48643752665e3e5798a192b27432a87d234
2d508a6e8979bba74b6fdf804c01a09a620c781e0fea73a8eefda904f5bcab25
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /owa/auth/15.0.1497/themes/resources/segoeui-semilight.ttf HTTP/1.1
Host: webmail.addaxpetroleum.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://login.bonma.ch
DNT: 1
Connection: keep-alive
Referer: https://login.bonma.ch/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: application/octet-stream
Content-Encoding: gzip
Last-Modified: Wed, 29 May 2019 00:02:58 GMT
Accept-Ranges: bytes
ETag: "0e579dfb115d51:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
request-id: d27be103-8b54-4a69-8bbf-9d84a98b25f2
Set-Cookie: ClientId=BORZRBWUZDVUWYW; expires=Fri, 14-Feb-2025 15:56:10 GMT; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Thu, 15 Feb 2024 15:56:10 GMT
Content-Length: 25487
webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/favicon.ico
52.136.245.70200 OK 7.9 kB URL GET HTTP/1.1 webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/favicon.ico
IP 52.136.245.70:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://login.bonma.ch/.owa./#ccendejas@soboba.com
Certificate IssuerDigiCert Inc
Subjectsmtp.addaxpetroleum.com
Fingerprint63:F4:03:E9:26:C2:9F:F0:C4:7B:F2:A3:D4:26:75:B1:F8:B2:F1:89
ValidityWed, 31 May 2023 00:00:00 GMT - Sun, 30 Jun 2024 23:59:59 GMT
File type MS Windows icon resource - 3 icons, 32x32, 32 bits/pixel, 24x24, 32 bits/pixel
Hash 759fade9033aa298629e4b000dcd6dde
34a1adf5c7326d7bde5b5735471b5d81e611c189
cf0808a61ec571e0c4975663903b288009d55502ac0445d9948983b339a5cf6e
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /owa/auth/15.0.1497/themes/resources/favicon.ico HTTP/1.1
Host: webmail.addaxpetroleum.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://login.bonma.ch/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: image/x-icon
Last-Modified: Wed, 29 May 2019 00:02:58 GMT
Accept-Ranges: bytes
ETag: "0e579dfb115d51:0"
Server: Microsoft-IIS/10.0
request-id: e84f6cd3-629f-4a66-aac7-8e69ffb9b770
Set-Cookie: ClientId=FLKMQPOPKYXO0PFINNIA; expires=Fri, 14-Feb-2025 15:56:11 GMT; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Thu, 15 Feb 2024 15:56:10 GMT
Content-Length: 7886
api.ipify.org/?format=json
104.26.12.205200 OK 21 B URL GET HTTP/2 api.ipify.org/?format=json
IP 104.26.12.205:443
Requested by https://login.bonma.ch/.owa./#ccendejas@soboba.com
Certificate IssuerGoogle Trust Services LLC
Subjectipify.org
Fingerprint28:D1:02:BC:05:04:D3:30:95:89:DB:04:0B:15:C8:7C:73:5D:A4:C2
ValidityMon, 22 Jan 2024 16:43:15 GMT - Sun, 21 Apr 2024 16:43:14 GMT
Hash 7d69c71af0f191e9a72db6153f8018d1
f67c5f2887bc05654b47f76e9621e53a4091aed1
5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65
GET /?format=json HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://login.bonma.ch
DNT: 1
Connection: keep-alive
Referer: https://login.bonma.ch/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 15 Feb 2024 15:56:11 GMT
content-type: application/json
content-length: 21
access-control-allow-origin: *
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 855ebd4918980b41-OSL
X-Firefox-Spdy: h2
webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf
52.136.245.70200 OK 26 kB URL GET HTTP/1.1 webmail.addaxpetroleum.com/owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf
IP 52.136.245.70:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://login.bonma.ch/.owa./#ccendejas@soboba.com
Certificate IssuerDigiCert Inc
Subjectsmtp.addaxpetroleum.com
Fingerprint63:F4:03:E9:26:C2:9F:F0:C4:7B:F2:A3:D4:26:75:B1:F8:B2:F1:89
ValidityWed, 31 May 2023 00:00:00 GMT - Sun, 30 Jun 2024 23:59:59 GMT
File type TrueType Font data, 18 tables, 1st "LTSH"
Hash 3770e9f182e8a34a4438a13395f7f11f
a8f77f7f5773e433f2538b4d05bd4c00675ec74e
898e0eafc6348daf0894cb328792b3d5d416a7117099472d6b50a96d1727e736
GET /owa/auth/15.0.1497/themes/resources/segoeui-regular.ttf HTTP/1.1
Host: webmail.addaxpetroleum.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://login.bonma.ch
DNT: 1
Connection: keep-alive
Referer: https://login.bonma.ch/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: public,max-age=2592000
Content-Type: application/octet-stream
Content-Encoding: gzip
Last-Modified: Wed, 29 May 2019 00:02:58 GMT
Accept-Ranges: bytes
ETag: "0e579dfb115d51:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
request-id: 36711813-e183-42ff-b6b7-0fa0da016ac6
Set-Cookie: ClientId=XNEFOOTUWGEUWPBNVA; expires=Fri, 14-Feb-2025 15:56:10 GMT; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Thu, 15 Feb 2024 15:56:10 GMT
Content-Length: 33540
104.21.70.189200 OK 27 kB URL User Request GET HTTP/3 IP 104.21.70.189:443
Certificate IssuerGoogle Trust Services LLC
Subjectbonma.ch
Fingerprint6F:9E:5F:7C:DF:2B:F7:08:6C:98:DD:5B:92:6A:9D:55:B7:77:A4:94
ValidityThu, 25 Jan 2024 13:27:44 GMT - Wed, 24 Apr 2024 13:27:43 GMT
File type HTML document, ASCII text, with very long lines (7882)
Hash ce4a608db93e927713d85db2b4bb56f9
c65a61b635adc6aa2ee74bef5bf130037c51c130
bc9a2f53be874cdae28461bcbe7f837caa3b3a0f2235ecf6d3c3837c4067d5fd
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /.owa./ HTTP/1.1
Host: login.bonma.ch
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 15 Feb 2024 15:56:10 GMT
content-type: text/html
last-modified: Thu, 15 Feb 2024 01:01:15 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rO%2FR3OGXA4EqlkRW92wNuCX44%2BP4WDw13l6AT%2FJkef70EdL9NSLtUJ8XIZWqwMsXKNKI%2B44V9452omyzsEGCtf0RAMsmPNFPL5lB3igWKp0j72Ti4%2FDLSgGFAJCK4rpQIg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 855ebd44bf28568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400