Report - tr.cloudmagic.com/h/v6/link-track/1.0/1653586175111584-e5449996-ded2-d04e-76e6-83302b700c39/1653586158/25a6df233274f31d935e851802d6946d/fa6e8cf070e2759f5f1587cf217f3cfe/ce5f7a01e55be7e4e4aad4df40697507?redirect_uri=gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn

Report Overview

URL

tr.cloudmagic.com/h/v6/link-track/1.0/1653586175111584-e5449996-ded2-d04e-76e6-83302b700c39/1653586158/25a6df233274f31d935e851802d6946d/fa6e8cf070e2759f5f1587cf217f3cfe/ce5f7a01e55be7e4e4aad4df40697507?redirect_uri=gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn
IP

54.86.136.244

ASN

#14618 AMAZON-AES
Submitted

2023-05-29T00:15:59Z

Access

public
Tags

phishing microsoft outlook
urlquery detections

Phishing - Microsoft Outlook

Detections

urlquery

4
Network Intrusion Detection

0
Threat Detection Systems

8

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
umitw.fobidaa.ru (7)	unknown	2023-05-15 02:02:53	2023-05-28 09:50:59	4622	171327	104.21.37.66
unpkg.com (2)	11693	2016-01-08 00:26:01	2023-05-28 05:11:47	830	64800	104.16.122.175
tr.cloudmagic.com (1)	429629	2017-01-30 08:12:23	2023-05-28 05:52:49	737	786	52.72.251.57
gjz.digifieds.sa.com (1)	unknown	No data	No data	522	264	162.241.69.179

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator
2023-05-29	medium	gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn
2023-05-29	medium	umitw.fobidaa.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cea8b6d4da1067b
2023-05-29	medium	umitw.fobidaa.ru/boot/14357b58027272e9c18ad0568126c4236473eeb697a8d
2023-05-29	medium	umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
2023-05-29	medium	umitw.fobidaa.ru/jq/14357b58027272e9c18ad0568126c4236473eeb697a7b
2023-05-29	medium	umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
2023-05-29	medium	umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
2023-05-29	medium	umitw.fobidaa.ru/jm/14357b58027272e9c18ad0568126c4236473eeb697a8e

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (9)

HTTP Transactions (11)

URL IP Response Size

tr.cloudmagic.com/h/v6/link-track/1.0/1653586175111584-e5449996-ded2-d04e-76e6-83302b700c39/1653586158/25a6df233274f31d935e851802d6946d/fa6e8cf070e2759f5f1587cf217f3cfe/ce5f7a01e55be7e4e4aad4df40697507?redirect_uri=gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn

52.72.251.57

302 Found

192

URL User Request GET HTTP/1.1

tr.cloudmagic.com/h/v6/link-track/1.0/1653586175111584-e5449996-ded2-d04e-76e6-83302b700c39/1653586158/25a6df233274f31d935e851802d6946d/fa6e8cf070e2759f5f1587cf217f3cfe/ce5f7a01e55be7e4e4aad4df40697507?redirect_uri=gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn
IP

52.72.251.57:443
ASN

#14618 AMAZON-AES

Certificate

IssuerAmazon

Subject*.cloudmagic.com

Fingerprint28:0A:34:90:F2:15:2A:54:CE:F8:ED:BE:15:51:DB:60:55:B8:AF:9B

ValidityMon, 20 Feb 2023 00:00:00 GMT - Thu, 16 Nov 2023 23:59:59 GMT

Magic

HTML document, ASCII text, with no line terminators

Size

192
Hash

2e8ef65491b81020b8ee1d49c2de6727

b630b58e7dc0383d4c3c1698f55d1d5cf4a4d880

a3f4109b9808f895a81ce234218a88bb445dee1f5706cbcd9834317eeb95fa44

HTTP Headers

                                        GET /h/v6/link-track/1.0/1653586175111584-e5449996-ded2-d04e-76e6-83302b700c39/1653586158/25a6df233274f31d935e851802d6946d/fa6e8cf070e2759f5f1587cf217f3cfe/ce5f7a01e55be7e4e4aad4df40697507?redirect_uri=gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn HTTP/1.1
Host: tr.cloudmagic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 302 Found
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,cm-user-identifier,x-cmreqid,x-cmsid,x-cmsession
Access-Control-Allow-Methods: PUT, GET, POST, OPTIONS
Access-Control-Allow-Origin: https://calendar.newtonhq.com
Content-Type: text/html; charset=utf-8
Date: Mon, 29 May 2023 00:15:42 GMT
Location: https://gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn
Vary: Accept
Content-Length: 192
Connection: keep-alive

gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn

162.241.69.179

200 OK

URL User Request GET HTTP/1.1

gjz.digifieds.sa.com/nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn
IP

162.241.69.179:443
ASN

#46606 UNIFIEDLAYER-AS-1

Certificate

IssuerLet's Encrypt

Subject*.digifieds.sa.com

Fingerprint1A:E7:FB:C4:41:31:14:4E:54:E2:24:2D:9F:49:94:78:96:E7:D0:90

ValiditySun, 21 May 2023 10:53:24 GMT - Sat, 19 Aug 2023 10:53:23 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook
fortinet	Phishing

HTTP Headers

                                        GET /nmss.org/YnJpZ2l0dGUuc2Nob25mZWxkQG5tc3Mub3Jn HTTP/1.1
Host: gjz.digifieds.sa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Date: Mon, 29 May 2023 00:15:41 GMT
Server: Apache
refresh: 0;url=https://umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

umitw.fobidaa.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cea8b6d4da1067b

104.21.37.66

URL

umitw.fobidaa.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cea8b6d4da1067b
IP

104.21.37.66:0
ASN

#13335 CLOUDFLARENET

Magic

GIF image data, version 89a, 1 x 1\012- data

Size

42
Hash

d89746888da2d9510b64a9f031eaecd5

d5fceb6532643d0d84ffe09c40c481ecdf59e15a

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7cea8b6d4da1067b HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 200 OK
date: Mon, 29 May 2023 00:15:44 GMT
content-type: image/gif
content-length: 42
last-modified: Thu, 25 May 2023 08:39:03 GMT
etag: "646f1ea7-2a"
server: cloudflare
cf-ray: 7cea8b6e9ae2fabc-OSL
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Mon, 29 May 2023 02:15:44 GMT
cache-control: max-age=7200, public
accept-ranges: bytes

umitw.fobidaa.ru/boot/14357b58027272e9c18ad0568126c4236473eeb697a8d

104.21.37.66

200 OK

51039

URL GET HTTP/3

umitw.fobidaa.ru/boot/14357b58027272e9c18ad0568126c4236473eeb697a8d
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Requested by

https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

ASCII text, with very long lines (50758)

Size

51039
Hash

67176c242e1bdc20603c878dee836df3

27a71b00383d61ef3c489326b3564d698fc1227c

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /boot/14357b58027272e9c18ad0568126c4236473eeb697a8d HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Cookie: cf_clearance=qXCxdP5Dz_UCCub7jmkrUaWREJUSnmPBaAeGu502e70-1685319344-0-160; PHPSESSID=71629d37bc373d3a2bcad1a91d526341
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
date: Mon, 29 May 2023 00:15:50 GMT
content-type: application/javascript
last-modified: Mon, 22 May 2023 04:42:06 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AnJjLXFMcX6mcmrxexE%2Bs%2Fr4KjQPECZL7hP9OF4fgVNg5%2FTLN%2BTBBQNeWWHwv02vevlgxlJwcxIbVHdpucvuzIeR%2FUe6Vge6gzJrwOEpYFkvPzRRzz4INZLcH0VYYjGeNkBi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cea8b964e78fabc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

unpkg.com/axios@1.4.0/dist/axios.min.js

104.16.122.175

200 OK

31842

URL GET HTTP/2

unpkg.com/axios@1.4.0/dist/axios.min.js
IP

104.16.122.175:443
ASN

#13335 CLOUDFLARENET

Requested by

https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Certificate

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F

ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT

Magic

ASCII text, with very long lines (31803)

Size

31842
Hash

6470a918ba1fd4b8d0882df0269ddb82

97814fdab64aa7d1b30f082f9eb272d4b1ce18a2

fd4ce12a87594281afcee9c73a40fe7acc282bcc9e764fbb3afa1481a96a091e

HTTP Headers

                                        GET /axios@1.4.0/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://umitw.fobidaa.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Mon, 29 May 2023 00:15:50 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"7c62-l4FP2rZKp9GzDwgvnrJy1LHOGKI"
via: 1.1 fly.io
fly-request-id: 01GZP8TZEXW4PFCT61FHX2WRTS-fra
cf-cache-status: HIT
age: 2018442
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7cea8b96ac59b4fd-OSL
content-encoding: br
X-Firefox-Spdy: h2

umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org

104.21.37.66

302 Found

7351

URL User Request POST HTTP/3

umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

Size

7351
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook
fortinet	Phishing

HTTP Headers

                                        POST /Mbrigitte.schonfeld@nmss.org HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org?__cf_chl_tk=3IyR2KIEhHJpXbrVHFKf5Zx5W.JTbvjMo8HFU_nX4zo-1685319344-0-gaNycGzNC6U
Content-Type: application/x-www-form-urlencoded
Content-Length: 3147
Origin: https://umitw.fobidaa.ru
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 302 Found
date: Mon, 29 May 2023 00:15:50 GMT
content-type: text/html; charset=UTF-8
location: ./beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: cf_clearance=qXCxdP5Dz_UCCub7jmkrUaWREJUSnmPBaAeGu502e70-1685319344-0-160; path=/; expires=Tue, 28-May-24 00:15:50 GMT; domain=.fobidaa.ru; HttpOnly; Secure; SameSite=None
PHPSESSID=71629d37bc373d3a2bcad1a91d526341; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kv3vsRLIarRgr6cgA6LUjHl%2BxiQkQXjEe%2FZub%2FB3TMC%2FdiNHkJ2JGO%2FQn93sNqpd5o2PnwA2CIMyUY5I3QSoLlbt9H7HqFvgWREmi769c0HceH3nF3uOW1aW%2B%2Fhzt%2B8HWvEt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cea8b930d89fabc-OSL
alt-svc: h3=":443"; ma=86400

umitw.fobidaa.ru/jq/14357b58027272e9c18ad0568126c4236473eeb697a7b

104.21.37.66

200 OK

85578

URL GET HTTP/3

umitw.fobidaa.ru/jq/14357b58027272e9c18ad0568126c4236473eeb697a7b
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Requested by

https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

ASCII text, with very long lines (32065)

Size

85578
Hash

2f6b11a7e914718e0290410e85366fe9

69bb69e25ca7d5ef0935317584e6153f3fd9a88c

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /jq/14357b58027272e9c18ad0568126c4236473eeb697a7b HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Cookie: cf_clearance=qXCxdP5Dz_UCCub7jmkrUaWREJUSnmPBaAeGu502e70-1685319344-0-160; PHPSESSID=71629d37bc373d3a2bcad1a91d526341
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
date: Mon, 29 May 2023 00:15:50 GMT
content-type: application/javascript
last-modified: Mon, 22 May 2023 04:42:06 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iPyr%2BOihbyX9k90QOk01wOem1ZOizQzSvY%2F82oDfGIpoGrzW49i2MeETdKGI3U%2B4k4iMT6TNr6cDYiKckqIjdYGoxQ5eVHnhxLH6F9ZDzdq7D%2FKEf6K%2FgEMbREq7VJYu%2FXqO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cea8b964e77fabc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

unpkg.com/axios/dist/axios.min.js

104.16.122.175

302 Found

31842

URL GET HTTP/2

unpkg.com/axios/dist/axios.min.js
IP

104.16.122.175:443
ASN

#13335 CLOUDFLARENET

Requested by

https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Certificate

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F

ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT

Magic

Size

31842
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /axios/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://umitw.fobidaa.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 302 Found
date: Mon, 29 May 2023 00:15:50 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /axios@1.4.0/dist/axios.min.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01H1JDPW8WV8HZ0NJ3GBPT959W-fra
cf-cache-status: HIT
age: 68
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7cea8b968bfeb4fd-OSL
X-Firefox-Spdy: h2

umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org

104.21.37.66

403 Forbidden

7644

URL User Request GET HTTP/2

umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7812), with no line terminators

Size

7644
Hash

e32463a9bf72b3b00f60d44789b59698

7f6f12dda567a61efe2786e882581e0d7b1971e4

5e09259a684c5c2e874f79bc488b568425a4eab46846d1eef411c6e7b1cfac45

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook
fortinet	Phishing

HTTP Headers

                                        GET /Mbrigitte.schonfeld@nmss.org HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 403 Forbidden
date: Mon, 29 May 2023 00:15:44 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bispLNdbLPwpF2bJa2uDkW3yL7FmMGazf5Zc3VnugbBCVi6LfWU4bieMmRYIAJM5orFXOyNAKKJE86n6jm3SAQRzRyl%2FKuJ5%2FWld3DInmOuf8cENOvefCiTvW7d24IKVY4up"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7cea8b6d4da1067b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e

104.21.37.66

200 OK

7351

URL User Request GET HTTP/3

umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7407), with no line terminators

Size

7351
Hash

e0e0182bf127bb986a01b0c3870b6709

ac08d6b6de3290a612260a43e25c6027efc94639

dfe014c87588db479e43bac44638f0394e3775624092e2e8c59f80cd2192f114

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://umitw.fobidaa.ru/Mbrigitte.schonfeld@nmss.org?__cf_chl_tk=3IyR2KIEhHJpXbrVHFKf5Zx5W.JTbvjMo8HFU_nX4zo-1685319344-0-gaNycGzNC6U
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=qXCxdP5Dz_UCCub7jmkrUaWREJUSnmPBaAeGu502e70-1685319344-0-160; PHPSESSID=71629d37bc373d3a2bcad1a91d526341
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
date: Mon, 29 May 2023 00:15:50 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2z7KYq5NE94wr9K5KKyixqu4IW29Lys0x%2FysX12dm9y14jF7pHl5vQ7KTpZAoSFunRjkBjyYHy4d2yTnhT1Q7T30D%2BsPxZ6lYEEDYepM8SCqxIEyrE9mgDhXg80cjKEQCU6u"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cea8b952e23fabc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

umitw.fobidaa.ru/jm/14357b58027272e9c18ad0568126c4236473eeb697a8e

104.21.37.66

200 OK

7309

URL GET HTTP/3

umitw.fobidaa.ru/jm/14357b58027272e9c18ad0568126c4236473eeb697a8e
IP

104.21.37.66:443
ASN

#13335 CLOUDFLARENET

Requested by

https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Certificate

IssuerGoogle Trust Services LLC

Subjectfobidaa.ru

FingerprintC2:53:23:06:36:8E:B0:58:3A:5F:EE:09:24:43:38:AA:ED:E9:F6:D2

ValiditySun, 14 May 2023 10:27:52 GMT - Sat, 12 Aug 2023 10:27:51 GMT

Magic

ASCII text, with very long lines (7344), with no line terminators

Size

7309
Hash

f335e180c66cfa35ea3152a33884ec67

0b99d4d6d595e23b8c864f9c39d16813f886e850

7e317dfd820ab1a6759f565d267e82ecb5bd797b6fe89be4858f0174b709c324

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /jm/14357b58027272e9c18ad0568126c4236473eeb697a8e HTTP/1.1
Host: umitw.fobidaa.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://umitw.fobidaa.ru/beebb091955c06fa68b3eb8afc0bae516473eeb68959cPASbeebb091955c06fa68b3eb8afc0bae516473eeb68959e
Cookie: cf_clearance=qXCxdP5Dz_UCCub7jmkrUaWREJUSnmPBaAeGu502e70-1685319344-0-160; PHPSESSID=71629d37bc373d3a2bcad1a91d526341
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
date: Mon, 29 May 2023 00:15:50 GMT
content-type: application/javascript
last-modified: Mon, 22 May 2023 04:42:06 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UhIBBHG7rPNMcdpYHOmBs1gIuDP4CCKGSqLeugldpLNtfvmUePGtGO%2BWlWCFSkCEdda6CCxobrYpINUgtNB2CFmwZMVKHBcnaxfhf32W%2F%2BjSGjKHWoeFqraJ7ruoshiuyCLT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7cea8b964e7afabc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

#1 JS:Script (size: 7309)

#2 JS:Script (size: 79)

#3 JS:Script (size: 85578)

#4 JS:Script (size: 51039)

#5 JS:Script (size: 37)

#6 JS:Script (size: 34)

#1 JS:Eval (size: 13)

#2 JS:Eval (size: 4)

#3 JS:Eval (size: 2292)

HTTP Transactions (11)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

Magic

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

Magic

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

Magic

Size

Hash

HTTP Headers

URL User Request POST HTTP/3

IP