| mailstat.us/tr/t/qhzlek4sssl3sssl/7/https:/t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com |  184.73.182.153 | | 0 B |
URL mailstat.us/tr/t/qhzlek4sssl3sssl/7/https:/t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com IP184.73.182.153:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /tr/t/qhzlek4sssl3sssl/7/https:/t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com HTTP/1.1
Host: mailstat.us
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
date: Thu, 02 May 2024 18:40:54 GMT
server: Apache
location: https://t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com
content-security-policy: style-src 'self' b4g.baydin.com code.jquery.com ajax.googleapis.com fonts.googleapis.com maxcdn.bootstrapcdn.com 'unsafe-inline'; frame-src 'self' www.youtube.com api.recurly.com apis.google.com accounts.google.com platform.twitter.com player.vimeo.com https://td.doubleclick.net; img-src * data:; default-src 'self'; script-src 'self' www.boomeranggmail.com js.recurly.com code.jquery.com https://connect.facebook.net apis.google.com ssl.google-analytics.com maxcdn.bootstrapcdn.com *.googleapis.com www.google-analytics.com www.youtube.com b4g.baydin.com www.googletagmanager.com https://appsforoffice.microsoft.com https://platform.twitter.com d3js.org cdn.optimizely.com; font-src 'self' fonts.gstatic.com maxcdn.bootstrapcdn.com; connect-src 'self' api.recurly.com www.google-analytics.com *.googleapis.com b4g.baydin.com https://google.com/ccm/form-data/1031736249
x-frame-options: SAMEORIGIN
content-length: 0
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
connection: close
|
|
| ocsp.r2m03.amazontrust.com/ | 3.164.222.26 | | 471 B |
URL ocsp.r2m03.amazontrust.com/ IP3.164.222.26:0
Hashb1fd59385040d174eb50b958ae7476b9 373712c21b4d2e1be4593fdb1410291b06591075 ff3863b920101400111e8cde98743744ecc31ff033857e73ebd647e6717d80fb
POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Cache-Control: max-age=7200
Date: Thu, 02 May 2024 18:40:54 GMT
Server: ECAcc (amb/6AE8)
X-Cache: Miss from cloudfront
Via: 1.1 ab37fc2d73bd6e477f5652b6cb140162.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: ARN53-P1
X-Amz-Cf-Id: 0DKxWpuHZiNXenTBzsdtHqA5I1GAfRBaoYj_QxyBBwsEAJF0KuWpbA==
|
|
| t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com | 18.233.202.46 | | 52 kB |
URL t.yesware.com/tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com IP18.233.202.46:0
File typeHTML document, ASCII text, with very long lines (51419) Hasha83ea26ada05a9f952de80247db967a2 1ecfc02cdfea54d1a1d2ed89333d35815ac9c591 e6e05dda9d24d7d4c3ff89f6d7bd1585476e5c0a8f0be59d6ad820e6347f93ce
GET /tt/7252559912397571c185458556522137c9769852/a89070450854400528843c809c975714/9005288f35e7698edb3904aa25255991/dgp.parresia.com/erou/fmartinez@arbal.com HTTP/1.1
Host: t.yesware.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 02 May 2024 18:40:54 GMT
content-type: text/html; charset=utf-8
content-length: 52371
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
x-robots-tag: noindex
set-cookie: t=TN6g0e-jhoW4M_ILUfc0LA; domain=.yesware.com; path=/; expires=Tue, 02 May 2034 18:40:54 GMT; secure; HttpOnly; SameSite=None
x-request-id: 91ec3604-e492-4e52-921f-bf8c6ee470d3
x-runtime: 0.008628
strict-transport-security: max-age=63072000; includeSubDomains
X-Firefox-Spdy: h2
|
|
| dgp.parresia.com/erou/fmartinez@arbal.com | 103.153.183.192 | 302 Found | 0 B |
URL User Request GET HTTP/1.1dgp.parresia.com/erou/fmartinez@arbal.com IP103.153.183.192:443
CertificateIssuerLet's Encrypt Subjectdgp.parresia.com Fingerprint6A:DC:CA:EB:5A:FA:2B:78:77:7E:9E:87:6E:7E:A3:CE:70:6F:A6:10 ValidityTue, 23 Apr 2024 11:10:32 GMT - Mon, 22 Jul 2024 11:10:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /erou/fmartinez@arbal.com HTTP/1.1
Host: dgp.parresia.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 02 May 2024 18:40:55 GMT
Server: Apache
Location: https://eonesas.cloudns.ph/?imojqhjm&qrc=fmartinez@arbal.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| eonesas.cloudns.ph/?imojqhjm&qrc=fmartinez@arbal.com |  5.230.43.245 | 302 Found | 0 B |
URL User Request GET HTTP/1.1eonesas.cloudns.ph/?imojqhjm&qrc=fmartinez@arbal.com IP5.230.43.245:443
CertificateIssuerLet's Encrypt Subjecteonesas.cloudns.ph FingerprintF4:B7:E3:34:31:2E:D6:98:18:DB:29:87:79:9A:3A:86:B7:03:E0:F8 ValidityThu, 02 May 2024 10:51:19 GMT - Wed, 31 Jul 2024 10:51:18 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?imojqhjm&qrc=fmartinez@arbal.com HTTP/1.1
Host: eonesas.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=cycqbDtAvShp; path=/; samesite=none; secure; httponly
qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; path=/; samesite=none; secure; httponly
location: https://honesiercx.cloudns.ph?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2hvbmVzaWVyY3guY2xvdWRucy5waCIsImRvbWFpbiI6ImhvbmVzaWVyY3guY2xvdWRucy5waCIsImtleSI6ImN5Y3FiRHRBdlNocCIsInFyYyI6ImZtYXJ0aW5lekBhcmJhbC5jb20iLCJpYXQiOjE3MTQ2NzUyNzEsImV4cCI6MTcxNDY3NTM5MX0.gpRu_pOrHbJSN8TmKaqHBt2IxU8gf4O9g6F7_BQHfDE
Date: Thu, 02 May 2024 18:41:11 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| honesiercx.cloudns.ph/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2hvbmVzaWVyY3guY2xvdWRucy5waCIsImRvbWFpbiI6ImhvbmVzaWVyY3guY2xvdWRucy5waCIsImtleSI6ImN5Y3FiRHRBdlNocCIsInFyYyI6ImZtYXJ0aW5lekBhcmJhbC5jb20iLCJpYXQiOjE3MTQ2NzUyNzEsImV4cCI6MTcxNDY3NTM5MX0.gpRu_pOrHbJSN8TmKaqHBt2IxU8gf4O9g6F7_BQHfDE | 5.230.43.245 | 302 Found | 0 B |
URL User Request GET HTTP/1.1honesiercx.cloudns.ph/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2hvbmVzaWVyY3guY2xvdWRucy5waCIsImRvbWFpbiI6ImhvbmVzaWVyY3guY2xvdWRucy5waCIsImtleSI6ImN5Y3FiRHRBdlNocCIsInFyYyI6ImZtYXJ0aW5lekBhcmJhbC5jb20iLCJpYXQiOjE3MTQ2NzUyNzEsImV4cCI6MTcxNDY3NTM5MX0.gpRu_pOrHbJSN8TmKaqHBt2IxU8gf4O9g6F7_BQHfDE IP5.230.43.245:443
CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2hvbmVzaWVyY3guY2xvdWRucy5waCIsImRvbWFpbiI6ImhvbmVzaWVyY3guY2xvdWRucy5waCIsImtleSI6ImN5Y3FiRHRBdlNocCIsInFyYyI6ImZtYXJ0aW5lekBhcmJhbC5jb20iLCJpYXQiOjE3MTQ2NzUyNzEsImV4cCI6MTcxNDY3NTM5MX0.gpRu_pOrHbJSN8TmKaqHBt2IxU8gf4O9g6F7_BQHfDE HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=cycqbDtAvShp; path=/; samesite=none; secure; httponly
qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; path=/; samesite=none; secure; httponly
location: /?qrc=fmartinez%40arbal.com
Date: Thu, 02 May 2024 18:41:11 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| honesiercx.cloudns.ph/?qrc=fmartinez%40arbal.com | 5.230.43.245 | 302 Moved Temporarily | 0 B |
URL User Request GET HTTP/1.1honesiercx.cloudns.ph/?qrc=fmartinez%40arbal.com IP5.230.43.245:443
CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?qrc=fmartinez%40arbal.com HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://honesiercx.cloudns.ph/owa/?login_hint=fmartinez%40arbal.com
Server: Microsoft-IIS/10.0
request-id: 4c58c0ae-e9ff-6629-2a1a-4e08c3d6526d
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: FR2P281CA0083, FR2P281CA0083
X-RequestId: dad6bf8c-008f-4fa1-b53e-178e74f48ac8
X-FEProxyInfo: FR2P281CA0083.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: FRA
MS-CV: rsBYTP/pKWYqGk4Iw9ZSbQ.0
X-Powered-By: ASP.NET
Date: Thu, 02 May 2024 18:41:11 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| honesiercx.cloudns.ph/owa/?login_hint=fmartinez%40arbal.com | 5.230.43.245 | 302 Found | 1.4 kB |
URL User Request GET HTTP/1.1honesiercx.cloudns.ph/owa/?login_hint=fmartinez%40arbal.com IP5.230.43.245:443
CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeHTML document, ASCII text, with very long lines (793), with CRLF, LF line terminators Hash71397bb8132f2eb5a61466f6c75fc7c6 f9011b6586a684375abb94e71c65610e27ca624c 45e530df1ea6fff22cd176c47e24cbdebc3dce286aa3c9563970735386fb3675
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /owa/?login_hint=fmartinez%40arbal.com HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
content-length: 1373
Content-Type: text/html; charset=utf-8
Location: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Server: Microsoft-IIS/10.0
request-id: cad5126c-8df2-4d4c-c57c-f6ddd02d72c8
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedBETarget: FR4P281MB4205.DEUP281.PROD.OUTLOOK.COM
X-BackEndHttpStatus: 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=FD4ECF8D4C13433A9F537909F682F40A; expires=Fri, 02-May-2025 18:41:12 GMT; path=/;SameSite=None; secure
ClientId=FD4ECF8D4C13433A9F537909F682F40A; expires=Fri, 02-May-2025 18:41:12 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Sat, 02-Nov-2024 18:41:12 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; expires=Thu, 02-May-2024 19:41:12 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OptInPrg=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
ClientId=FD4ECF8D4C13433A9F537909F682F40A; expires=Fri, 02-May-2025 18:41:12 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Sat, 02-Nov-2024 18:41:12 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=honesiercx.cloudns.ph; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; expires=Thu, 02-May-2024 19:41:12 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
OptInPrg=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Mon, 02-May-1994 18:41:12 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; expires=Fri, 03-May-2024 00:43:12 GMT; path=/;SameSite=None; secure; HttpOnly
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS7
X-OWA-DiagnosticsInfo: 1;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-05-02T18:41:12.056
X-BackEnd-End: 2024-05-02T18:41:12.056
X-DiagInfo: FR4P281MB4205
X-BEServer: FR4P281MB4205
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-Proxy-BackendServerStatus: 302
X-FirstHopCafeEFZ: FRA
X-FEProxyInfo: FR4P281CA0092.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: FRA
X-FEServer: FR4P281CA0092
Date: Thu, 02 May 2024 18:41:11 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= | 5.230.43.245 | 200 OK | 35 kB |
URL User Request GET HTTP/1.1honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= IP5.230.43.245:443
CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (22705), with CRLF, LF line terminators Hash2fe4ab9e3da7852b3cf60108aaa377f3 2da04ec7c31fe929e50f2dd71015b2a43c85fe39 de54392877cc86671510518d4ad911245bd0420c939be54c5a37bbe7af12bb33
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://t.yesware.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: 706730a1-bae7-4738-8b37-62ed51ab5800
x-ms-ests-server: 2.1.17968.10 - WUS3 ProdSlices
x-ms-srs: 1.P
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy-Report-Only: script-src 'self' 'nonce-whbsyeyPvDdbHrmEWQf8yQ' 'unsafe-eval' 'unsafe-inline' 'report-sample'; object-src 'none'; frame-src 'self' https://*.live.com https://*.office.com https://*.microsoft.com https://autologon.microsoftazuread-sso.com https://webshell.suite.office.com https://outlook.office365.com https://portal.azure.com https://signout.sharepoint.com https://portal.microsoftonline.com https://apps.powerapps.com https://admin.microsoft365.com https://account.activedirectory.windowsazure.com https://www.msn.com https://www.microsoftstart.com https://www.start.com https://jarvis-west-int-aux-tm.trafficmanager.net https://www.onenote.com https://admin.exchange.microsoft.com https://www.yammer.com https://web.yammer.com https://businesscentral.dynamics.com https://app.vssps.visualstudio.com https://o365spo-signout.sharepoint-df.com https://admin.teams.microsoft.com https://login.windows.net https://portal.rescueicm.com https://ccs.login.microsoftonline.com https://make.powerautomate.com https://insights.cloud.microsoft https://insights.viva.office.com; base-uri 'self'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
Set-Cookie: buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; expires=Sat, 01-Jun-2024 18:41:12 GMT; path=/; secure; HttpOnly; SameSite=None
esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; domain=honesiercx.cloudns.ph; path=/; secure; HttpOnly; SameSite=None
esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; domain=honesiercx.cloudns.ph; path=/; secure; HttpOnly; SameSite=None
fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; expires=Sat, 01-Jun-2024 18:41:12 GMT; path=/; secure; HttpOnly; SameSite=None
x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Thu, 02 May 2024 18:41:11 GMT
Connection: close
content-length: 39127
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js | 5.230.43.245 | 200 OK | 689 kB |
URL GET HTTP/1.1honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js IP5.230.43.245:443
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeJavaScript source, ASCII text Size689 kB (689017 bytes) Hash3e89ae909c6a8d8c56396830471f3373 2632f95a5be7e4c589402bf76e800a8151cd036b 6665ca6a09f770c6679556eb86cf4234c8bdb0271049620e03199b34b4a16099
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /aadcdn.msauth.net/~/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 689017
Content-Type: application/x-javascript
Date: Thu, 02 May 2024 18:41:12 GMT
Connection: keep-alive
Keep-Alive: timeout=5
|
|
| honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico | 5.230.43.245 | 200 OK | 17 kB |
URL GET HTTP/1.1honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico IP5.230.43.245:443
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeMS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors Hash12e3dac858061d088023b2bd48e2fa96 e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 02 May 2024 18:41:13 GMT
Content-Type: image/x-icon
Content-Length: 17174
Connection: close
Cache-Control: public, max-age=31536000
Last-Modified: Sun, 18 Oct 2020 03:02:03 GMT
ETag: 0x8D8731230C851A6
x-ms-request-id: f4164a00-f01e-005d-48cb-9159b6000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Access-Control-Allow-Origin: *
x-azure-ref: 20240502T184113Z-15ff4544644l8mj8b66rzfcz0s0000000ndg00000000pgwn
x-fd-int-roxy-purgeid: 4554691
X-Cache: TCP_HIT
Accept-Ranges: bytes
|
|
| csp.microsoft.com/report/ESTS-UX-All |  0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3429
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| csp.microsoft.com/report/ESTS-UX-All | 0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3430
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| csp.microsoft.com/report/ESTS-UX-All | 0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3422
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| honesiercx.cloudns.ph/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js | 5.230.43.245 | 200 OK | 55 kB |
URL GET HTTP/1.1honesiercx.cloudns.ph/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js IP5.230.43.245:443
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 02 May 2024 18:41:13 GMT
Content-Type: application/x-javascript
content-length: 55037
Connection: close
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Last-Modified: Tue, 02 Apr 2024 21:29:16 GMT
ETag: 0x8DC535BF32A6F5D
x-ms-request-id: 724b9479-c01e-002e-3ab1-92d6b0000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Access-Control-Allow-Origin: *
x-azure-ref: 20240502T184113Z-15ff4544644wf9qk7yq667y1n00000000nk00000000146bq
x-fd-int-roxy-purgeid: 4554691
X-Cache: TCP_HIT
Accept-Ranges: bytes
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js | 5.230.43.245 | 200 OK | 190 kB |
URL GET HTTP/1.1honesiercx.cloudns.ph/aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js IP5.230.43.245:443
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size190 kB (190151 bytes) Hash5423589bece24019692486034da1076b 73e8b8d253ab670e8f8f26885977447d4bfc83be d4ea1a07b23257f411af4f8c20aa528d23c4dadbd4c81d5db454f5d82351adc4
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /aadcdn.msauth.net/~/shared/1.0/content/js/oneDs_641b1cf809bdc17b42ab.js HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 02 May 2024 18:41:13 GMT
Content-Type: application/x-javascript
content-length: 190151
Connection: close
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Last-Modified: Thu, 27 Oct 2022 14:24:13 GMT
ETag: 0x8DAB826EBE74413
x-ms-request-id: d3469a1b-001e-0032-1e7d-9c928b000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Access-Control-Allow-Origin: *
x-azure-ref: 20240502T184113Z-15ff4544644cm45918gb588fx4000000035000000000vx5r
x-fd-int-roxy-purgeid: 4554691
X-Cache: TCP_HIT
Accept-Ranges: bytes
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| csp.microsoft.com/report/ESTS-UX-All | 0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3429
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| csp.microsoft.com/report/ESTS-UX-All | 0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 3429
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| honesiercx.cloudns.ph/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css | 5.230.43.245 | 200 OK | 113 kB |
URL GET HTTP/1.1honesiercx.cloudns.ph/aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css IP5.230.43.245:443
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA= CertificateIssuerLet's Encrypt Subjecthonesiercx.cloudns.ph Fingerprint5C:02:C9:0E:7E:FC:D0:AB:05:EC:3A:DC:ED:AB:0B:1F:B9:3C:28:7C ValidityThu, 02 May 2024 10:53:24 GMT - Wed, 31 Jul 2024 10:53:23 GMT
File typeASCII text, with very long lines (61177) Size113 kB (113084 bytes) Hashd62b4edeb512b07abef4688e27ecdde3 981a7825da5e29938ab6fe0cbfe2db622f7b8333 4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /aadcdn.msauth.net/~/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1
Host: honesiercx.cloudns.ph
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
DNT: 1
Connection: keep-alive
Cookie: qPdM=cycqbDtAvShp; qPdM.sig=kGk6SLdKNJ8VVU4EOEeLXVB9HvM; ClientId=FD4ECF8D4C13433A9F537909F682F40A; OIDC=1; OpenIdConnect.nonce.v3.L1edF7tWRV6GSaLRWoaF4xjCmmCBc_pMxZxAMR62Dn0=638502720720565333.80d98194-7388-4323-9a7a-93a539d07e74; X-OWA-RedirectHistory=ArLym14BVXSrcNdq3Ag; buid=0.AXYAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8PwrvbCx7YOfl0DX_MCSrlqop8DQ1o6tPb1LIg4WqK8aqc1Up3d9nnvsl1oE-C5Z-huE860rB0nx8B-l33ecjgo4nELfp9UpoYZpxj-kTj_8gAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8-LcB5lMV6iz0bjWeaZwdSFB0XdBTPVACk9DhvKExwK1S7aR1smEOozCcZkqA3OJBZnaOl2smiRxanzfrcEGOi7u9ZEGCvjz64d07IFfCjpzIrPG8Y6Vx7LzwgdyBmyv2_A_j93G3VN7Aggz2VGBqEEMZ3B-SanLwTDOhdzc8gnwgAA; esctx-IwMZ4SageI4=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8mXHuA0WaEy8M-r8s1kYY-k86r4uqo4GXF054vIrCLs4OO_-oQRWDmwYFh-moAGP533E4RFnZunFOCxsToAzGvo5mC4l1qQPatvDzktHVo_wGy3xTyrDNYusQjSnLWjg9BFBQi9lWlHUMotTYWirZAyAA; fpc=AgMgE8YU5mZLohsOGBsHFYWerOTJAQAAAEfVxd0OAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 02 May 2024 18:41:13 GMT
Content-Type: text/css
Content-Length: 20314
Connection: close
Cache-Control: public, max-age=31536000
Content-Encoding: gzip
Last-Modified: Wed, 27 Dec 2023 18:18:12 GMT
ETag: 0x8DC07082FBB8D2B
x-ms-request-id: a0fb8fb0-401e-005e-3ec1-9824b0000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
Access-Control-Allow-Origin: *
x-azure-ref: 20240502T184113Z-15ff4544644xdxmsnurddp218400000007ug00000000nhe5
x-fd-int-roxy-purgeid: 4554691
X-Cache: TCP_HIT
Accept-Ranges: bytes
|
|
| csp.microsoft.com/report/ESTS-UX-All | 0.0.0.0 | | 0 B |
URL POST csp.microsoft.com/report/ESTS-UX-All IP0.0.0.0:0
Requested byhttps://honesiercx.cloudns.ph/?7ln4bjvvj=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD1mbWFydGluZXolNDBhcmJhbC5jb20mY2xpZW50LXJlcXVlc3QtaWQ9Y2FkNTEyNmMtOGRmMi00ZDRjLWM1N2MtZjZkZGQwMmQ3MmM4JnByb3RlY3RlZHRva2VuPXRydWUmY2xhaW1zPSU3YiUyMmlkX3Rva2VuJTIyJTNhJTdiJTIyeG1zX2NjJTIyJTNhJTdiJTIydmFsdWVzJTIyJTNhJTViJTIyQ1AxJTIyJTVkJTdkJTdkJTdkJm5vbmNlPTYzODUwMjcyMDcyMDU2NTMzMy44MGQ5ODE5NC03Mzg4LTQzMjMtOWE3YS05M2E1MzlkMDdlNzQmc3RhdGU9RFl2UkNzSXdEQUJiX1JaOTZ4YWJka2tlWko4eW9wdGEyRm9ZQThHdk4zQjNiLWVkYzJmelpIcXdPQnFRTTBTS1lPUWhJMkxITUF2ZkpBVkM1cEF3WWhBbERZS2FVV2FnaFpLMzk5cTNyX2JqMnQ2bFRwOVNqX3RyMF8wb2RmbGRFdWotMExWN3R1MFA=
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /report/ESTS-UX-All HTTP/1.1
Host: csp.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 2343
Origin: https://honesiercx.cloudns.ph
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
0.0.0.0