Report - m.exactag.com/ai.aspx?tc=d9812730bc40b07205bbd26a23a8d2e6b6b4f9&url=http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=

Report Overview

Submitted URL
m.exactag.com/ai.aspx?tc=d9812730bc40b07205bbd26a23a8d2e6b6b4f9&url=http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=
IP
213.202.235.9
ASN
#24961 myLoc managed IT AG
Submitted
2024-05-07 15:11:20
Access
public
Website Title
Login
Final URL
bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Tags
phishing microsoft outlook
urlquery detections
Phishing - Microsoft Outlook

Detections

urlquery
13
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
m.exactag.com	11114	2010-08-24	2015-04-09	2024-05-06	578 B	1.0 kB	213.202.235.10
empireglass.ae	unknown	unknown	No data	No data	421 B	230 B	198.54.126.64
gopowerssolutions.com	unknown	unknown	No data	No data	509 B	581 B	5.230.70.60
bldllcs.net	unknown	unknown	No data	No data	16 kB	343 kB	5.230.70.60

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	bldllcs.net/static/shared/lib/jquery/jquery.min.js?v=ff152	90 kB	2024-03-07	2024-05-07
Pretty URL bldllcs.net/static/shared/lib/jquery/jquery.min.js?v=ff152 IP 5.230.70.60 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-07 18:01:26 Last Seen2024-05-07 17:11:27 Times Seen32 Hash f061735b98b3859450bd3844bd854257 28a494cc9eb2ddbdc0b24d4f19a4d2e56a453d65 a2d7f1f557778adef33166539ba18b592613be119e0be0b353b579e8fcf411c6 Loading...

	bldllcs.net/static/js/page/email-first.js?v=8d753	1.0 MB	2024-05-07	2024-05-07
Pretty URL bldllcs.net/static/js/page/email-first.js?v=8d753 IP 5.230.70.60 ASN #12586 GHOSTnet GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 17:11:26 Last Seen2024-05-07 17:11:27 Times Seen2 Hash 42f268fde7952840e723fd1fd7d411ce 17edc65395c9ad3ebb86589245f5e6b6f4438cee ce1c2672f9255c7e393e9b6744cb5b9a5b4173f93b50e0ff0fdde6c2e2b50eb2 Loading...

	data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo=	341 B	2023-10-02	2024-05-18
Pretty URL data:text/javascript;base64,ZnVuY3Rpb24gYygpe2lmKCFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuYiIpIHx8ICFkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCIuZyIpKXtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImIiXX0pKTtkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuc3R5bGUuZmlsdGVyPSJodWUtcm90YXRlKDRkZWcpIjtkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKE9iamVjdC5hc3NpZ24oZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2Iikse2NsYXNzTGlzdDpbImciXX0pKTtzZXRUaW1lb3V0KGMsMWUzKX19YygpOwo= IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-02 01:17:43 Last Seen2024-05-18 17:56:42 Times Seen33527 Hash d6f18bfe02b31db3664d5d27f03ea142 aae6f850e8ea4ff74dcd6213ad6a4565cbd6802e 90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221 Loading...

HTTP Transactions (14)

URL IP Response Size

m.exactag.com/ai.aspx?tc=d9812730bc40b07205bbd26a23a8d2e6b6b4f9&url=http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=

213.202.235.10

0 B

URL
m.exactag.com/ai.aspx?tc=d9812730bc40b07205bbd26a23a8d2e6b6b4f9&url=http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=
IP
213.202.235.10:0
ASN
#24961 myLoc managed IT AG

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /ai.aspx?tc=d9812730bc40b07205bbd26a23a8d2e6b6b4f9&url=http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20= HTTP/1.1
Host: m.exactag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Di, 07 Mai 2024 03:10:54 GMT
Location: http:empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Max-Age: 1000
Access-Control-Allow-Headers: *
X-ET-Code: 20
X-ET-Camp: 0
X-ET-Monitoring: 1
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Strict-Transport-Security: max-age=31536000
Date: Tue, 07 May 2024 15:10:53 GMT
Connection: close
Content-Length: 0
cross-origin-resource-policy: cross-origin
X-Xss-Protection: 0
X-Content-Type-Options: nosniff

empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=

198.54.126.64

0 B

URL
empireglass.ae/real/53321//Y2JhdWVyQGR2bG5ldC5jb20=
IP
198.54.126.64:0
ASN
#22612 NAMECHEAP-NET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /real/53321//Y2JhdWVyQGR2bG5ldC5jb20= HTTP/1.1
Host: empireglass.ae
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
date: Tue, 07 May 2024 15:10:54 GMT
server: Apache
refresh: 0;url=https://gopowerssolutions.com/?abnhljlk&email=cbauer@dvlnet.com
accept-ranges: none
content-length: 0
content-type: text/html; charset=UTF-8

gopowerssolutions.com/?abnhljlk&email=cbauer@dvlnet.com

5.230.70.60

302 Found

0 B

URL User Request GET HTTP/1.1
gopowerssolutions.com/?abnhljlk&email=cbauer@dvlnet.com
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectgopowerssolutions.com
FingerprintE4:20:E0:0B:24:10:E8:C4:14:E5:4E:9C:1E:0C:56:7E:6A:4C:C5:B8
ValidityThu, 25 Apr 2024 03:18:30 GMT - Wed, 24 Jul 2024 03:18:29 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?abnhljlk&email=cbauer@dvlnet.com HTTP/1.1
Host: gopowerssolutions.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Set-Cookie: qPdM=qBQQPGJLobkK; path=/; samesite=none; secure; httponly
qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; path=/; samesite=none; secure; httponly
location: https://bldllcs.net?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJxQlFRUEdKTG9ia0siLCJxcmMiOiJjYmF1ZXJAZHZsbmV0LmNvbSIsImlhdCI6MTcxNTA5NDY1NCwiZXhwIjoxNzE1MDk0Nzc0fQ.X1vBlkRDOWVekrRcSJI6xWKyQqfClwIbLdFRpTfbv4U
Date: Tue, 07 May 2024 15:10:54 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

bldllcs.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJxQlFRUEdKTG9ia0siLCJxcmMiOiJjYmF1ZXJAZHZsbmV0LmNvbSIsImlhdCI6MTcxNTA5NDY1NCwiZXhwIjoxNzE1MDk0Nzc0fQ.X1vBlkRDOWVekrRcSJI6xWKyQqfClwIbLdFRpTfbv4U

5.230.70.60

302 Found

0 B

URL User Request GET HTTP/1.1
bldllcs.net/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJxQlFRUEdKTG9ia0siLCJxcmMiOiJjYmF1ZXJAZHZsbmV0LmNvbSIsImlhdCI6MTcxNTA5NDY1NCwiZXhwIjoxNzE1MDk0Nzc0fQ.X1vBlkRDOWVekrRcSJI6xWKyQqfClwIbLdFRpTfbv4U
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2JsZGxsY3MubmV0IiwiZG9tYWluIjoiYmxkbGxjcy5uZXQiLCJrZXkiOiJxQlFRUEdKTG9ia0siLCJxcmMiOiJjYmF1ZXJAZHZsbmV0LmNvbSIsImlhdCI6MTcxNTA5NDY1NCwiZXhwIjoxNzE1MDk0Nzc0fQ.X1vBlkRDOWVekrRcSJI6xWKyQqfClwIbLdFRpTfbv4U HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Set-Cookie: qPdM=qBQQPGJLobkK; path=/; samesite=none; secure; httponly
qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; path=/; samesite=none; secure; httponly
location: /?qrc=cbauer%40dvlnet.com
Date: Tue, 07 May 2024 15:10:55 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

bldllcs.net/?qrc=cbauer%40dvlnet.com

5.230.70.60

302 Moved Temporarily

0 B

URL User Request GET HTTP/1.1
bldllcs.net/?qrc=cbauer%40dvlnet.com
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?qrc=cbauer%40dvlnet.com HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://bldllcs.net/owa/?login_hint=cbauer%40dvlnet.com
Server: Microsoft-IIS/10.0
request-id: fc7fba1d-ae61-459b-7d79-ea9aa10f21a8
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: PAYP264CA0015, PAYP264CA0015
X-RequestId: 3504669c-82f2-4f71-9a99-b6cfc42c0a55
X-FEProxyInfo: PAYP264CA0015.FRAP264.PROD.OUTLOOK.COM
X-FEEFZInfo: ORY
MS-CV: Hbp//GGum0V9eeqaoQ8hqA.0
X-Powered-By: ASP.NET
Date: Tue, 07 May 2024 15:10:54 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

bldllcs.net/owa/?login_hint=cbauer%40dvlnet.com

5.230.70.60

302 Found

1.4 kB

URL User Request GET HTTP/1.1
bldllcs.net/owa/?login_hint=cbauer%40dvlnet.com
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
HTML document, ASCII text, with very long lines (770), with CRLF, LF line terminators
Size
1.4 kB (1350 bytes)
Hash
ec353c2cb840dd5cf91eea2ea4bba429
e097f176f44a27b1a7a62a323d6cb5d182ab57e2
5fdd4fcb6eaf80407f5a422b745e2fefc171195ce302413c772bfe7237201c8b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /owa/?login_hint=cbauer%40dvlnet.com HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
content-length: 1350
Content-Type: text/html; charset=utf-8
Location: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jYmF1ZXIlNDBkdmxuZXQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTMyYjM1MzA2LTY3MTgtMTcwOS0wZjkzLTk1YzU5MmUxMzJkOCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5MTQ1NTU4MjA3OTEuNTg4NWQwZGEtNzYzYy00YjkwLWI2OWEtMjY2ZWQwYmI2MTUwJnN0YXRlPURZdEJEb01nRUFDaGZrV1A2S0xzQ29lbVR6RXNrTmJFUXRMWS12M3VZZVl5R2EyVTZvU2JvRUdrVmxvOEFnWHJFTkhQc0FZN292ZVlJVWNqTVJuSEFReFRpR1ltS2htWXlTSm9lZnVwWFhGNkhPMjUxLTIxMV9PZU9IN0xaM0NRZjBjdDU1amEtdzg=
Server: Microsoft-IIS/10.0
request-id: 32b35306-6718-1709-0f93-95c592e132d8
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedFETarget: PA7P264CU017.internal.outlook.com
X-BackEndHttpStatus: 302, 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=70267D959CBE4CF9982BCA3E9845CDAF; expires=Wed, 07-May-2025 15:10:55 GMT; path=/;SameSite=None; secure
ClientId=70267D959CBE4CF9982BCA3E9845CDAF; expires=Wed, 07-May-2025 15:10:55 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Thu, 07-Nov-2024 15:10:55 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; expires=Tue, 07-May-2024 16:10:55 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OptInPrg=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
ClientId=70267D959CBE4CF9982BCA3E9845CDAF; expires=Wed, 07-May-2025 15:10:55 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Thu, 07-Nov-2024 15:10:55 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=bldllcs.net; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; expires=Tue, 07-May-2024 16:10:55 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
OptInPrg=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sat, 07-May-1994 15:10:55 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; expires=Tue, 07-May-2024 21:12:55 GMT; path=/;SameSite=None; secure; HttpOnly
X-CalculatedBETarget: PR0P264MB3451.FRAP264.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS6
X-OWA-DiagnosticsInfo: 1;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-05-07T15:10:55.582
X-BackEnd-End: 2024-05-07T15:10:55.582
X-DiagInfo: PR0P264MB3451
X-BEServer: PR0P264MB3451
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
X-Proxy-BackendServerStatus: 302
X-FEProxyInfo: PAYP264CA0014.FRAP264.PROD.OUTLOOK.COM
X-FEEFZInfo: ORY
X-FEServer: PA7P264CA0248, PAYP264CA0014
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-FirstHopCafeEFZ: ORY
Date: Tue, 07 May 2024 15:10:55 GMT
Connection: close
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

bldllcs.net/?9p14cx306=aHR0cHM6Ly9zc28tZjc0Mjk0Yjcuc3NvLmR1b3NlY3VyaXR5LmNvbS93cy9zcC9ESUMzRzRHNUpGWjNaUVc5SjNNWi9wYXNzaXZlP2xvZ2luX2hpbnQ9Y2JhdWVyJTQwZHZsbmV0LmNvbSZjbGllbnQtcmVxdWVzdC1pZD0zMmIzNTMwNi02NzE4LTE3MDktMGY5My05NWM1OTJlMTMyZDgmdXNlcm5hbWU9Y2JhdWVyJTQwZHZsbmV0LmNvbSZ3YT13c2lnbmluMS4wJnd0cmVhbG09dXJuJTNhZmVkZXJhdGlvbiUzYU1pY3Jvc29mdE9ubGluZSZ3Y3R4PWVzdHNyZWRpcmVjdCUzZDIlMjZlc3RzcmVxdWVzdCUzZHJRUUlBUkFBalZFOWJCSmhBT1hqNkZucVQ3R0xiaVlYcHlZSDN4M2NjUkJOcEpSQ2hmSlRTdVUwaHR6UGQzQWNkeDl5ZDVTMllYSXh1cENxZzVvNHVHaVlfRmtNazR0TEp3YUhwcFBHcFhFd3hxbHhhSVM0dU9rYlhsN3lYdDd3M2lMQkJKbjRaZmdITEQxbEdtb2FReXRvcXY1Q1oyRXVRSmJmc1Jmcl9ndnpEeDlfM1B2Q0hnekJwWWJqdE8xNEtJUmRwNFd4RWNTYXBpc29xR0F6aExlazBIc0F4Z0FjQWJEblBhX0lrb3M2MTlSdXkwTE9OREgwUnZtd3dFRS14a1E0amhOWUdJMHhRVTRRT0JXcUVqMHhGVG9peHlBdDh6R0pabmtlcVZDV2VZYURoOTc1UXNKMUd1eVVjRWZmUVQtOWZnMTN6Rm9iMjg1VDRnRllGcDJsWmJ4V1R5V1NEYzI0VWVTek9UdUprYm14azdLTnZKd3FPVG1SN29aZEVZbmJhWW10OExnczQxVGEyR3hoSVZHdmRsTDVUTkZPaUZIY1JlSnFSV211clZ1WlJLbTNvYWRGTTlzd3hlM3lkWXcwdDEydHJ2Q1pBc3N4Tk1zd3RRSXFaS0s1bS1Ga1NZT0t3M0ZOaWQ0U2hzUl9EZnlXSUNlYm1OamFKMGpjUnBhdWpuM2dzdzk4ODNuaDdMRVB2SmlaUEhEeWlIeXBQci1fT3JqNzFUdXlybmoyWjBKR0tlX0ltMHVjM20yc3F6d01yOGdzbHUtSWJWUnZsTEs0MUtzWXNLbDBZQ1VtQzFkamNXWkFnZ0ZKamtqX0xCSHdVRVN5eUJ5UjRBY0o3cDN5alB6X3VuTjhHaHllaWN5UlNrdlNUWHRoY1pmUzFacUREV1JSOFYycVo5bzFSWm1xcnRSeWtVM0ZiMUdUZnVwMnY5X19jTlp6Zk83TnJ5ZXZUajQ5LTU1NUhmRDhCZzIj

5.230.70.60

302 Found

0 B

URL User Request GET HTTP/1.1
bldllcs.net/?9p14cx306=aHR0cHM6Ly9zc28tZjc0Mjk0Yjcuc3NvLmR1b3NlY3VyaXR5LmNvbS93cy9zcC9ESUMzRzRHNUpGWjNaUVc5SjNNWi9wYXNzaXZlP2xvZ2luX2hpbnQ9Y2JhdWVyJTQwZHZsbmV0LmNvbSZjbGllbnQtcmVxdWVzdC1pZD0zMmIzNTMwNi02NzE4LTE3MDktMGY5My05NWM1OTJlMTMyZDgmdXNlcm5hbWU9Y2JhdWVyJTQwZHZsbmV0LmNvbSZ3YT13c2lnbmluMS4wJnd0cmVhbG09dXJuJTNhZmVkZXJhdGlvbiUzYU1pY3Jvc29mdE9ubGluZSZ3Y3R4PWVzdHNyZWRpcmVjdCUzZDIlMjZlc3RzcmVxdWVzdCUzZHJRUUlBUkFBalZFOWJCSmhBT1hqNkZucVQ3R0xiaVlYcHlZSDN4M2NjUkJOcEpSQ2hmSlRTdVUwaHR6UGQzQWNkeDl5ZDVTMllYSXh1cENxZzVvNHVHaVlfRmtNazR0TEp3YUhwcFBHcFhFd3hxbHhhSVM0dU9rYlhsN3lYdDd3M2lMQkJKbjRaZmdITEQxbEdtb2FReXRvcXY1Q1oyRXVRSmJmc1Jmcl9ndnpEeDlfM1B2Q0hnekJwWWJqdE8xNEtJUmRwNFd4RWNTYXBpc29xR0F6aExlazBIc0F4Z0FjQWJEblBhX0lrb3M2MTlSdXkwTE9OREgwUnZtd3dFRS14a1E0amhOWUdJMHhRVTRRT0JXcUVqMHhGVG9peHlBdDh6R0pabmtlcVZDV2VZYURoOTc1UXNKMUd1eVVjRWZmUVQtOWZnMTN6Rm9iMjg1VDRnRllGcDJsWmJ4V1R5V1NEYzI0VWVTek9UdUprYm14azdLTnZKd3FPVG1SN29aZEVZbmJhWW10OExnczQxVGEyR3hoSVZHdmRsTDVUTkZPaUZIY1JlSnFSV211clZ1WlJLbTNvYWRGTTlzd3hlM3lkWXcwdDEydHJ2Q1pBc3N4Tk1zd3RRSXFaS0s1bS1Ga1NZT0t3M0ZOaWQ0U2hzUl9EZnlXSUNlYm1OamFKMGpjUnBhdWpuM2dzdzk4ODNuaDdMRVB2SmlaUEhEeWlIeXBQci1fT3JqNzFUdXlybmoyWjBKR0tlX0ltMHVjM20yc3F6d01yOGdzbHUtSWJWUnZsTEs0MUtzWXNLbDBZQ1VtQzFkamNXWkFnZ0ZKamtqX0xCSHdVRVN5eUJ5UjRBY0o3cDN5alB6X3VuTjhHaHllaWN5UlNrdlNUWHRoY1pmUzFacUREV1JSOFYycVo5bzFSWm1xcnRSeWtVM0ZiMUdUZnVwMnY5X19jTlp6Zk83TnJ5ZXZUajQ5LTU1NUhmRDhCZzIj
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?9p14cx306=aHR0cHM6Ly9zc28tZjc0Mjk0Yjcuc3NvLmR1b3NlY3VyaXR5LmNvbS93cy9zcC9ESUMzRzRHNUpGWjNaUVc5SjNNWi9wYXNzaXZlP2xvZ2luX2hpbnQ9Y2JhdWVyJTQwZHZsbmV0LmNvbSZjbGllbnQtcmVxdWVzdC1pZD0zMmIzNTMwNi02NzE4LTE3MDktMGY5My05NWM1OTJlMTMyZDgmdXNlcm5hbWU9Y2JhdWVyJTQwZHZsbmV0LmNvbSZ3YT13c2lnbmluMS4wJnd0cmVhbG09dXJuJTNhZmVkZXJhdGlvbiUzYU1pY3Jvc29mdE9ubGluZSZ3Y3R4PWVzdHNyZWRpcmVjdCUzZDIlMjZlc3RzcmVxdWVzdCUzZHJRUUlBUkFBalZFOWJCSmhBT1hqNkZucVQ3R0xiaVlYcHlZSDN4M2NjUkJOcEpSQ2hmSlRTdVUwaHR6UGQzQWNkeDl5ZDVTMllYSXh1cENxZzVvNHVHaVlfRmtNazR0TEp3YUhwcFBHcFhFd3hxbHhhSVM0dU9rYlhsN3lYdDd3M2lMQkJKbjRaZmdITEQxbEdtb2FReXRvcXY1Q1oyRXVRSmJmc1Jmcl9ndnpEeDlfM1B2Q0hnekJwWWJqdE8xNEtJUmRwNFd4RWNTYXBpc29xR0F6aExlazBIc0F4Z0FjQWJEblBhX0lrb3M2MTlSdXkwTE9OREgwUnZtd3dFRS14a1E0amhOWUdJMHhRVTRRT0JXcUVqMHhGVG9peHlBdDh6R0pabmtlcVZDV2VZYURoOTc1UXNKMUd1eVVjRWZmUVQtOWZnMTN6Rm9iMjg1VDRnRllGcDJsWmJ4V1R5V1NEYzI0VWVTek9UdUprYm14azdLTnZKd3FPVG1SN29aZEVZbmJhWW10OExnczQxVGEyR3hoSVZHdmRsTDVUTkZPaUZIY1JlSnFSV211clZ1WlJLbTNvYWRGTTlzd3hlM3lkWXcwdDEydHJ2Q1pBc3N4Tk1zd3RRSXFaS0s1bS1Ga1NZT0t3M0ZOaWQ0U2hzUl9EZnlXSUNlYm1OamFKMGpjUnBhdWpuM2dzdzk4ODNuaDdMRVB2SmlaUEhEeWlIeXBQci1fT3JqNzFUdXlybmoyWjBKR0tlX0ltMHVjM20yc3F6d01yOGdzbHUtSWJWUnZsTEs0MUtzWXNLbDBZQ1VtQzFkamNXWkFnZ0ZKamtqX0xCSHdVRVN5eUJ5UjRBY0o3cDN5alB6X3VuTjhHaHllaWN5UlNrdlNUWHRoY1pmUzFacUREV1JSOFYycVo5bzFSWm1xcnRSeWtVM0ZiMUdUZnVwMnY5X19jTlp6Zk83TnJ5ZXZUajQ5LTU1NUhmRDhCZzIj HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Tue, 07 May 2024 15:10:56 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: close
Server: Duo/1.0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: 0
Pragma: no-cache
Location: /email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Strict-Transport-Security: max-age=31536000
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a

5.230.70.60

200 OK

1.1 kB

URL User Request GET HTTP/1.1
bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
HTML document, ASCII text, with very long lines (508)
Size
1.1 kB (1061 bytes)
Hash
fc66aa90fa99e91ff34ff2156c379068
d3ad74912616aacdc65c494dfc3e6283975dc608
37f22f03cb01b2a8be6925375145ea1a50c439ba827e3547dc5eadd47df0ce2c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:10:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Server: Duo/1.0
X-Duo-Endpoint-Health-Appserver-URL: https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101
X-Duo-Endpoint-Health-URI: com-duosecurity-devicehealth://*
Etag: W/"4bd20d43ade621386a5566628f82ceca031d6584"
Set-Cookie: _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; Path=/; SameSite=None; Secure
sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; HttpOnly; Path=/; SameSite=None; Secure
sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"; HttpOnly; Path=/; SameSite=None; Secure
Strict-Transport-Security: max-age=31536000
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Content-Encoding: gzip

bldllcs.net/static/css/page/email-first.css?v=96e76

5.230.70.60

200 OK

13 kB

URL GET HTTP/1.1
bldllcs.net/static/css/page/email-first.css?v=96e76
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Requested by
https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
ASCII text, with very long lines (11150)
Size
13 kB (13103 bytes)
Hash
0a0005f274754225abf5a106390c4c54
1a2dceb23fca4c10aa0a353dfc300d02d90c9690
96e7692605b400a8402dbba95b94895a1bc021815694aae0855adec7e134b4b7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /static/css/page/email-first.css?v=96e76 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:10:58 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: close
Server: Duo/1.0
Last-Modified: Fri, 26 Apr 2024 18:09:05 GMT
ETag: W/"662bedc1-100d8"
Cache-Control: private, no-cache
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src 'none'; style-src 'self'; script-src 'self'; font-src 'self'; frame-src 'self'  ; frame-ancestors 'none'; img-src 'self'  ; connect-src 'self'
Content-Encoding: gzip

bldllcs.net/static/shared/lib/jquery/jquery.min.js?v=ff152

5.230.70.60

200 OK

31 kB

URL GET HTTP/1.1
bldllcs.net/static/shared/lib/jquery/jquery.min.js?v=ff152
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Requested by
https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30948 bytes)
Hash
f061735b98b3859450bd3844bd854257
28a494cc9eb2ddbdc0b24d4f19a4d2e56a453d65
a2d7f1f557778adef33166539ba18b592613be119e0be0b353b579e8fcf411c6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /static/shared/lib/jquery/jquery.min.js?v=ff152 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:10:58 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: close
Server: Duo/1.0
Last-Modified: Fri, 26 Apr 2024 18:09:05 GMT
ETag: W/"662bedc1-15d9d"
Cache-Control: private, no-cache
Strict-Transport-Security: max-age=31536000
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Content-Encoding: gzip

bldllcs.net/static/js/page/email-first.js?v=8d753

5.230.70.60

200 OK

258 kB

URL GET HTTP/1.1
bldllcs.net/static/js/page/email-first.js?v=8d753
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Requested by
https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
JavaScript source, ASCII text, with very long lines (65467)
Size
258 kB (258215 bytes)
Hash
42f268fde7952840e723fd1fd7d411ce
17edc65395c9ad3ebb86589245f5e6b6f4438cee
ce1c2672f9255c7e393e9b6744cb5b9a5b4173f93b50e0ff0fdde6c2e2b50eb2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /static/js/page/email-first.js?v=8d753 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:10:58 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: close
Server: Duo/1.0
Last-Modified: Fri, 26 Apr 2024 18:09:05 GMT
ETag: W/"662bedc1-f5205"
Cache-Control: private, no-cache
Strict-Transport-Security: max-age=31536000
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Content-Encoding: gzip

bldllcs.net/static/images/favicon_duo.ico?v=e3716

5.230.70.60

200 OK

6.5 kB

URL GET HTTP/1.1
bldllcs.net/static/images/favicon_duo.ico?v=e3716
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Requested by
https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
6.5 kB (6518 bytes)
Hash
20cfaa5b470512d11e83dd9aa80108d1
6b1bf56025d1c4d1f03c59ae200878c091e8f162
e3716418443b70443d794bbcd2a8020a2e67d5260d3fff2ee8ef7fe5d51767f5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /static/images/favicon_duo.ico?v=e3716 HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:11:00 GMT
Content-Type: image/x-icon
Content-Length: 6518
Connection: close
Server: Duo/1.0
Last-Modified: Fri, 26 Apr 2024 18:09:05 GMT
ETag: "662bedc1-1976"
Cache-Control: private, no-cache
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src 'none'; style-src 'self'; script-src 'self'; font-src 'self'; frame-src 'self'  ; frame-ancestors 'none'; img-src 'self'  ; connect-src 'self'
Accept-Ranges: bytes

bldllcs.net/logo

5.230.70.60

200 OK

11 kB

URL GET HTTP/1.1
bldllcs.net/logo
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Requested by
https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type
PNG image data, 128 x 128, 8-bit/color RGB, non-interlaced
Size
11 kB (11135 bytes)
Hash
b537fbeae742f5fa2f59daeb44a3be91
7dba0ae64b26fa74d2cb2327f055f7bc6c0d4fdf
68049c5b48930b6255fb05eb1b78a9fe989a61ead05f1fd15db641ddcf54d378

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /logo HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bldllcs.net/email_first?authkey=ASET6KIYS2UB1NSJYRJP&scid=4e633763f4f042b4b8d5ce5dbb912a5a
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag; buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; _xsrf="YTVjZmQyZWZiMTVlNDgyNzg4ZWM2NWU5MWRjNTIzODg=|1715094657|8e3363dc33af58d53cdf6443f31afdb5e4c63a74"; sid="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|bcfde10b0b6314a2fb3256f7f29c53ab0b9b0c5a"; sid-init-9dbec4bcf8a84a3880e97e069f644aa4="MTlkY2VmZmM2OTk3NGNmZmJmMzIyOTM1ODRkMzRhNmE=|1715094657|5b30e1f5ae91eef12d58f297e8faee62a8fb473f"
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 07 May 2024 15:11:00 GMT
Content-Type: image/png
Content-Length: 11135
Connection: close
Server: Duo/1.0
Etag: "7dba0ae64b26fa74d2cb2327f055f7bc6c0d4fdf"
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Robots-Tag: noindex, nofollow
Content-Security-Policy: default-src 'none'; style-src 'self'; script-src 'self'; font-src 'self'; frame-src 'self'  ; frame-ancestors 'none'; img-src 'self'  ; connect-src 'self'

bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jYmF1ZXIlNDBkdmxuZXQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTMyYjM1MzA2LTY3MTgtMTcwOS0wZjkzLTk1YzU5MmUxMzJkOCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5MTQ1NTU4MjA3OTEuNTg4NWQwZGEtNzYzYy00YjkwLWI2OWEtMjY2ZWQwYmI2MTUwJnN0YXRlPURZdEJEb01nRUFDaGZrV1A2S0xzQ29lbVR6RXNrTmJFUXRMWS12M3VZZVl5R2EyVTZvU2JvRUdrVmxvOEFnWHJFTkhQc0FZN292ZVlJVWNqTVJuSEFReFRpR1ltS2htWXlTSm9lZnVwWFhGNkhPMjUxLTIxMV9PZU9IN0xaM0NRZjBjdDU1amEtdzg=

5.230.70.60

302 Found

2.1 kB

URL User Request GET HTTP/1.1
bldllcs.net/?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jYmF1ZXIlNDBkdmxuZXQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTMyYjM1MzA2LTY3MTgtMTcwOS0wZjkzLTk1YzU5MmUxMzJkOCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5MTQ1NTU4MjA3OTEuNTg4NWQwZGEtNzYzYy00YjkwLWI2OWEtMjY2ZWQwYmI2MTUwJnN0YXRlPURZdEJEb01nRUFDaGZrV1A2S0xzQ29lbVR6RXNrTmJFUXRMWS12M3VZZVl5R2EyVTZvU2JvRUdrVmxvOEFnWHJFTkhQc0FZN292ZVlJVWNqTVJuSEFReFRpR1ltS2htWXlTSm9lZnVwWFhGNkhPMjUxLTIxMV9PZU9IN0xaM0NRZjBjdDU1amEtdzg=
IP
5.230.70.60:443
ASN
#12586 GHOSTnet GmbH

Certificate
IssuerLet's Encrypt
Subjectbldllcs.net
Fingerprint32:EE:C1:EF:C0:95:4F:3F:E5:33:DA:85:B7:1E:1D:A1:B8:91:67:9E
ValidityTue, 30 Apr 2024 12:19:17 GMT - Mon, 29 Jul 2024 12:19:16 GMT

File type

Size
2.1 kB (2072 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /?9p14cx306=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1jYmF1ZXIlNDBkdmxuZXQuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTMyYjM1MzA2LTY3MTgtMTcwOS0wZjkzLTk1YzU5MmUxMzJkOCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDY5MTQ1NTU4MjA3OTEuNTg4NWQwZGEtNzYzYy00YjkwLWI2OWEtMjY2ZWQwYmI2MTUwJnN0YXRlPURZdEJEb01nRUFDaGZrV1A2S0xzQ29lbVR6RXNrTmJFUXRMWS12M3VZZVl5R2EyVTZvU2JvRUdrVmxvOEFnWHJFTkhQc0FZN292ZVlJVWNqTVJuSEFReFRpR1ltS2htWXlTSm9lZnVwWFhGNkhPMjUxLTIxMV9PZU9IN0xaM0NRZjBjdDU1amEtdzg= HTTP/1.1
Host: bldllcs.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=qBQQPGJLobkK; qPdM.sig=iAdVMkQm4zlbztxeg6H53Xmyjms; ClientId=70267D959CBE4CF9982BCA3E9845CDAF; OIDC=1; OpenIdConnect.nonce.v3.JMSrG-J_KS8h04Dy_nVJRdIapAfD4NsoGBXjPxnd-kM=638506914555820791.5885d0da-763c-4b90-b69a-266ed0bb6150; X-OWA-RedirectHistory=ArLym14B9_q65Kdu3Ag
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Location: https://bldllcs.net/?9p14cx306=aHR0cHM6Ly9zc28tZjc0Mjk0Yjcuc3NvLmR1b3NlY3VyaXR5LmNvbS93cy9zcC9ESUMzRzRHNUpGWjNaUVc5SjNNWi9wYXNzaXZlP2xvZ2luX2hpbnQ9Y2JhdWVyJTQwZHZsbmV0LmNvbSZjbGllbnQtcmVxdWVzdC1pZD0zMmIzNTMwNi02NzE4LTE3MDktMGY5My05NWM1OTJlMTMyZDgmdXNlcm5hbWU9Y2JhdWVyJTQwZHZsbmV0LmNvbSZ3YT13c2lnbmluMS4wJnd0cmVhbG09dXJuJTNhZmVkZXJhdGlvbiUzYU1pY3Jvc29mdE9ubGluZSZ3Y3R4PWVzdHNyZWRpcmVjdCUzZDIlMjZlc3RzcmVxdWVzdCUzZHJRUUlBUkFBalZFOWJCSmhBT1hqNkZucVQ3R0xiaVlYcHlZSDN4M2NjUkJOcEpSQ2hmSlRTdVUwaHR6UGQzQWNkeDl5ZDVTMllYSXh1cENxZzVvNHVHaVlfRmtNazR0TEp3YUhwcFBHcFhFd3hxbHhhSVM0dU9rYlhsN3lYdDd3M2lMQkJKbjRaZmdITEQxbEdtb2FReXRvcXY1Q1oyRXVRSmJmc1Jmcl9ndnpEeDlfM1B2Q0hnekJwWWJqdE8xNEtJUmRwNFd4RWNTYXBpc29xR0F6aExlazBIc0F4Z0FjQWJEblBhX0lrb3M2MTlSdXkwTE9OREgwUnZtd3dFRS14a1E0amhOWUdJMHhRVTRRT0JXcUVqMHhGVG9peHlBdDh6R0pabmtlcVZDV2VZYURoOTc1UXNKMUd1eVVjRWZmUVQtOWZnMTN6Rm9iMjg1VDRnRllGcDJsWmJ4V1R5V1NEYzI0VWVTek9UdUprYm14azdLTnZKd3FPVG1SN29aZEVZbmJhWW10OExnczQxVGEyR3hoSVZHdmRsTDVUTkZPaUZIY1JlSnFSV211clZ1WlJLbTNvYWRGTTlzd3hlM3lkWXcwdDEydHJ2Q1pBc3N4Tk1zd3RRSXFaS0s1bS1Ga1NZT0t3M0ZOaWQ0U2hzUl9EZnlXSUNlYm1OamFKMGpjUnBhdWpuM2dzdzk4ODNuaDdMRVB2SmlaUEhEeWlIeXBQci1fT3JqNzFUdXlybmoyWjBKR0tlX0ltMHVjM20yc3F6d01yOGdzbHUtSWJWUnZsTEs0MUtzWXNLbDBZQ1VtQzFkamNXWkFnZ0ZKamtqX0xCSHdVRVN5eUJ5UjRBY0o3cDN5alB6X3VuTjhHaHllaWN5UlNrdlNUWHRoY1pmUzFacUREV1JSOFYycVo5bzFSWm1xcnRSeWtVM0ZiMUdUZnVwMnY5X19jTlp6Zk83TnJ5ZXZUajQ5LTU1NUhmRDhCZzIj
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: a70694fe-9e64-498a-9083-e302ba6e3c00
x-ms-ests-server: 2.1.17968.10 - EUS ProdSlices
x-ms-srs: 1.P
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: buid=0.ARsAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8i_B63_JdrTyf-YRbwZ6bX34Yj2qIGSUuqtO8hbNJWzUeY4giTgCCqaj_MCOSF858ykisg3i5PUcqWrf_DUoLb9Y-55X2u5T6rHEqUp2h5EggAA; expires=Thu, 06-Jun-2024 15:10:56 GMT; path=/; secure; HttpOnly; SameSite=None
fpc=Au2SsVKDtCZLsAnPt0L9xo6erOTJAQAAAH87zN0OAAAA; expires=Thu, 06-Jun-2024 15:10:56 GMT; path=/; secure; HttpOnly; SameSite=None
esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8TW3uLtetOcpESN5O-AIZfpRJm2UFm4J5W2fa1Giq-Y7SkeR4bWSHBVrIyWTbmO63FYJ6T7bPlNXA1DiVgQuHC_vYQxrJZcTUaRCUj0Syx1KBhT7kox8uY8SiQroFG9SE3x_zwtxg8Wd0ZIGOorfMxDUL8nGfrCxYAMrUHJD1BJ0gAA; domain=bldllcs.net; path=/; secure; HttpOnly; SameSite=None
cltm=CgAQABoAIgQIDBAF; domain=bldllcs.net; path=/; secure; HttpOnly; SameSite=None
x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Tue, 07 May 2024 15:10:55 GMT
Connection: close
content-length: 1675
Content-Security-Policy: default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval';  script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers