Report - ef7link.com/asdf/Y2hhcmxlc0BkYXZpZHNvbnNsYXd5ZXJzLmNvbQ==

Report Overview

Visited public
2023-12-05 13:39:29
Tags
phishing microsoft outlook
URL
ef7link.com/asdf/Y2hhcmxlc0BkYXZpZHNvbnNsYXd5ZXJzLmNvbQ==
Finishing URL
b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
IP / ASN
162.241.85.202
#46606 UNIFIEDLAYER-AS-1
Title
Loading
Phishing - Microsoft Outlook

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
b464.m0rx1.com	unknown	2023-11-30	2023-12-01 04:56:34	2023-12-04 20:29:57	8.2 kB	514 kB	172.67.201.169
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20 07:02:03	2023-12-05 05:09:09	5.7 kB	442 kB	104.17.2.184
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-12-05 05:09:20	422 B	90 kB	151.101.130.137
cdn.socket.io	62068	2010-04-18	2015-03-23 23:14:03	2023-12-05 05:52:18	423 B	46 kB	143.204.55.70
ef7link.com	unknown	2023-02-08	2023-02-12 03:42:46	2023-12-04 20:29:46	523 B	324 B	162.241.85.202

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	challenges.cloudflare.com/turnstile/v0/api.js?render=explicit	ScriptElement	34 kB	2023-11-30	2023-12-14
Pretty URL challenges.cloudflare.com/turnstile/v0/api.js?render=explicit IP 104.17.2.184 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-30 14:29 Last Seen2023-12-14 14:42 Times Seen11689 Hash 8c90f391245a994ae95e644a587c8626 7bfc99336571d0ccfe38f9e1d18cb26b4adfc316 acbe221d9bb71e85d0a3b52a7a9d44ee4669ab664186b32d0c737a2be62681e7 Loading...

	challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal	ScriptElement	3.1 kB	2024-08-20	2024-08-20
Pretty URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal IP 104.17.2.184 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-20 16:41 Last Seen2024-08-20 16:41 Times Seen1 Hash c117840bcbc9a0c487b8f4b6994827ed 9a2928dc97a0504c2c7e809a115415310fe93955 383ba10bd31225f48088f93f1cdba3075befb3584c2f42b6d3b485503b01d4f1 Loading...

	unknown	ScriptElement	371 B	2023-12-04	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-04 20:30 Last Seen2024-08-20 16:47 Times Seen855 Hash 69590b0b552c3dbb6fce433756aa4458 f7d258e6ef3af0c9bc82260157df5d0c9f96da82 8db4fa723999d564782473afadecfbdacff770144daf9282f582f8fb89c68bf5 Loading...

	cdn.socket.io/4.6.0/socket.io.min.js	ScriptElement	46 kB	2023-04-05	2025-05-10
Pretty URL cdn.socket.io/4.6.0/socket.io.min.js IP 143.204.55.70 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 03:09 Last Seen2025-05-10 08:41 Times Seen38493 Hash 80f5b8c6a9eeac15de93e5a112036a06 f7174635137d37581b11937fc90e9cb325077bce 0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542 Loading...

	unknown	Function	26 B	2023-04-11	2025-05-11
Pretty Introduced by Function Embedded in HTML false Observations First Seen2023-04-11 21:13 Last Seen2025-05-11 16:57 Times Seen127488 Hash 1c862db5f2555377c2dc1e62ed7b3981 c29e6dc25c08a70995127ec13ded6f80d9a36174 27d373a6961f797edf69a80f7f24877ef85c2fc4f9f770b2540b1bf5e66823ac Loading...

	b464.m0rx1.com/web6/assets/js/pages-head-web.min.js?cb=1	ScriptElement	9.5 kB	2023-11-23	2024-08-20
Pretty URL b464.m0rx1.com/web6/assets/js/pages-head-web.min.js?cb=1 IP 172.67.201.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-23 23:16 Last Seen2024-08-20 18:07 Times Seen3141 Hash e2663af643d013c14c8124da541ca2d0 6fdff694fa243006c25083b91ec51aa28f8568a7 31ae6827f3782d745a595d0b9c858aed76784fb6b8a050792bcd869c484363dd Loading...

	b464.m0rx1.com/90z5/myscr948587.js	ScriptElement	28 kB	2023-12-04	2023-12-11
Pretty URL b464.m0rx1.com/90z5/myscr948587.js IP 172.67.201.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-04 20:30 Last Seen2023-12-11 20:07 Times Seen855 Hash 798732c053c5578616e807f16f769d4f cec3425b57280902e85f812358350362dad12799 a20b33ba5e7a21a1bd276fa6c94adda93e8b4e0daaf3770ef545a5f74295e334 Loading...

	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-05-11
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 16:56 Times Seen205894 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	b464.m0rx1.com/web6/assets/js/pages-head-top-web.min.js?cb=1701783557614	ScriptElement	2.5 kB	2023-12-05	2024-08-20
Pretty URL b464.m0rx1.com/web6/assets/js/pages-head-top-web.min.js?cb=1701783557614 IP 172.67.201.169 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-05 03:09 Last Seen2024-08-20 16:44 Times Seen920 Hash e4d4ac8b0368a6b2d1f4c8bc5101b6b6 41a5b910f027cf26f58d212c673e1c4b7d288965 bf238e428816d92b7f5e5c98f1c8f74db5fded35a7f52e88f97e1444ec0f3907 Loading...

	challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=830cb1a268d55699	ScriptElement	171 kB	2023-12-05	2023-12-05
Pretty URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=830cb1a268d55699 IP 104.17.2.184 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-05 14:39 Last Seen2023-12-05 14:39 Times Seen1 Hash 6eb9b2ee3ee472f41dc7cc2cb1b339ce be36ae7ea1f18cdd29b079a18ecf675594f47ae6 09d4068013ae9813ca7fd02cc6cd6d748dd59c61f6a80fd23170d0b5702e64ea Loading...

		Size	First Seen	Last Seen
	#1 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07 01:03	2025-05-11 16:54
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-11 16:54 Times Seen369095 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#2 Eval - 03c09367a835bc521517da016cd506b9	143 B	2023-11-30 14:30	2024-08-20 17:20
Pretty Observations First Seen2023-11-30 14:30 Last Seen2024-08-20 17:20 Times Seen2080 Hash 03c09367a835bc521517da016cd506b9 bb0cbefdced0cf1412029463af699c012303f33f a74bb1d583af3798269afcdd5e72e54d4c8e551f94482869cb42dfe9db283cbb Loading...

		Size	First Seen	Last Seen
	#1 Write - 6c7af0a531fc7404ea48925fda186625	4.8 kB	2023-12-04 20:30	2024-08-20 16:47
Pretty Observations First Seen2023-12-04 20:30 Last Seen2024-08-20 16:47 Times Seen855 Hash 6c7af0a531fc7404ea48925fda186625 842e0fef08c69f38abe00ccb7f28c8665e00dc8a 3d1a5fcd8f92048be1119824ffde8cac7cebc6e45a91fdf87a1d7066e32fe5b4 Loading...

	#2 Write - d50fe447c67a515d4ba936505175a8fe	3.6 kB	2023-11-30 14:29	2024-08-20 17:20
Pretty Observations First Seen2023-11-30 14:29 Last Seen2024-08-20 17:20 Times Seen11653 Hash d50fe447c67a515d4ba936505175a8fe 78d20da444441fb45dcf61e09d9bcbc9f01502e2 7dcf7a54137031c03f28f6a33cb62b258023c5de06d504259d5ad39f16b1b85e Loading...

HTTP Transactions (29)

URL IP Response Size

ef7link.com/asdf/Y2hhcmxlc0BkYXZpZHNvbnNsYXd5ZXJzLmNvbQ==

162.241.85.202

128 B

URL
ef7link.com/asdf/Y2hhcmxlc0BkYXZpZHNvbnNsYXd5ZXJzLmNvbQ==
IP
162.241.85.202:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type
HTML document, ASCII text
Size
128 B (128 bytes)
Hash
01bc5eb5e82555766c5e1a992e0a3552
77a0873bffe163f83de89d0dab23d8212d7b5ab0
82d054f82892a324f880b39a4a21b6fbed1bf5bddf8fba94e6cde24a2859a4bb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /asdf/Y2hhcmxlc0BkYXZpZHNvbnNsYXd5ZXJzLmNvbQ== HTTP/1.1
Host: ef7link.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 128
content-type: text/html; charset=UTF-8
date: Tue, 05 Dec 2023 13:39:10 GMT
server: Apache
X-Firefox-Spdy: h2

b464.m0rx1.com/90z5/

172.67.201.169

39 kB

URL
b464.m0rx1.com/90z5/
IP
172.67.201.169:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document, ASCII text
Size
39 kB (38613 bytes)
Hash
cd5b79bbd1da988bdfa3f9d869979d52
4f9c1a58f973d3e31a835a9e3e08adee9d0359e0
12005a4085e7bb014dc451f624c42855509b9d18a5b5a2d12f754826a52935fe

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /90z5/ HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ef7link.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 05 Dec 2023 13:39:11 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i8FnBlcBI3y4R5kn7UKNIJKfJ7XQLXZClQzstck2MSkUcVrTCMGDgD5ftfH5uYONz%2BEC0WGnXWWr5Bh0r5AdgPfXS41Ila4tJ94Gdfd5g59HEQVenq2SxScUvkFHOGn%2FLg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 830cb19abaf41c0a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

b464.m0rx1.com/web6/assets/css/pages-okta.css?cb=1

172.67.201.169

200 OK

0 B

URL GET HTTP/3
b464.m0rx1.com/web6/assets/css/pages-okta.css?cb=1
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/css/pages-okta.css?cb=1 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/css
content-length: 0
last-modified: Wed, 08 Nov 2023 20:47:39 GMT
etag: "0-609aa32aa0b88"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8262
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CJdvv00nXQnxXsxU7yzogZKuZVStH64WnylBE9vtXNgQS1RDe4br1leD4%2FRb%2FfBFWZumtuVdor69f8TazMPKCRUO1Z57ZLmqWVVo91KFci1oE6deHBQDhNkRtp23"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1aed756a5-OSL

b464.m0rx1.com/web6/assets/fonts/GDSherpa-bold.woff2

172.67.201.169

200 OK

28 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-bold.woff2
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66\012- data
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-bold.woff2 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff2
content-length: 28000
last-modified: Thu, 24 Aug 2023 14:00:16 GMT
etag: "6d60-603aba5c97c00"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k8PBcwymtv5V%2FRc%2BL5HviiB1Cqo19vbvJ0w7NFvgaIOjcIQehGyfw46FOEEc%2Bld1X0PXFP%2FnIdYNOh1r1xWesScKGC03sJ%2Fm7dbwYt5WOK3Bt%2F1iNilmNmBTdcCZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1bef856a5-OSL

b464.m0rx1.com/web6/assets/fonts/GDSherpa-bold.woff

172.67.201.169

200 OK

36 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-bold.woff
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0\012- data
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-bold.woff HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff
content-length: 35970
last-modified: Thu, 24 Aug 2023 14:00:22 GMT
etag: "8c82-603aba6250980"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dt1ygWJghmlTKos0R0f8QpBbU8jvTJDPfqc8LZok5UoTo3qOQF%2F3Bbomb90GTAMCsKHKUylblLplgyDYZxaliCSU3a%2Fg12M6OKgOMxkAPqyCN59QSknK9xVpLk37"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1befb56a5-OSL

b464.m0rx1.com/web6/assets/fonts/GDSherpa-regular.woff2

172.67.201.169

200 OK

29 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-regular.woff2
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66\012- data
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-regular.woff2 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff2
content-length: 28584
last-modified: Thu, 24 Aug 2023 14:00:24 GMT
etag: "6fa8-603aba6438e00"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FsTWIGTeHkTC3Oj2HaX2zHsRakGVCd8t4sJWTw%2Fq0N4923snlYqJrRoC9j6AqrqRvh8zZK5sXljEo6ycAxdpCzduzlqIypEBszUaJGPGeWMKnn4H27CxL5IiR%2Fvx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1befc56a5-OSL

b464.m0rx1.com/web6/assets/fonts/GDSherpa-regular.woff

172.67.201.169

200 OK

37 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-regular.woff
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0\012- data
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-regular.woff HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff
content-length: 36696
last-modified: Thu, 24 Aug 2023 14:00:28 GMT
etag: "8f58-603aba6809700"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bz2iQv854FhJmW%2FowEJZNSGUpUDkceuOgvkiIeuOcRUbgA%2BbkRPpZh8dOnRJZyln8Dm0oMLTYcQl2z%2FnF6ZZ2KFk3eSij%2Bc1ZC0QFqiZ59w8F%2BcrjeliWiLxrxVY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1df1556a5-OSL

b464.m0rx1.com/web6/assets/css/pages.min.css?cb=1

172.67.201.169

200 OK

48 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/css/pages.min.css?cb=1
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text, with very long lines (17014), with no line terminators
Size
48 kB (47777 bytes)
Hash
4d38e2ffc538c11f0dca9cb2ad6ca08a
400ca5c484a88f9a91a1d1439e5f51a621ad3eaa
6b14e6f4239ef85c9180a099263a041df2b82bd65a245e72cca365cbd5e88fa8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/css/pages.min.css?cb=1 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/css
last-modified: Wed, 08 Nov 2023 20:47:39 GMT
etag: W/"4276-609aa32a97ee8-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8262
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IvM%2FEytU15d0ftAT5ZulNfTsB8w9wry0NgPi2UzGkxDe7qztxDitfBZ%2FsKECNsLPRSNWVQF2V9xctJ8cHsiPM3f4aVL%2FDIJNqn61Cx0BYohpqufrTcLu7cAx3Yig"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 830cb1a19eb656a5-OSL
content-encoding: br

b464.m0rx1.com/web6/assets/fonts/GDSherpa-vf2.woff2

172.67.201.169

200 OK

93 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-vf2.woff2
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0\012- data
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-vf2.woff2 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff2
content-length: 93276
last-modified: Thu, 24 Aug 2023 14:00:32 GMT
etag: "16c5c-603aba6bda000"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wHfS%2BA1k88wZhFI%2BPxT6N1fJxq0AHkyneAnBCKxjom6w7kHODzUuPBljrP%2BdBrtzLTqYPT8FoeyuP5kiNqpsE45ELtSBAidcNrPcIsBqZJNgN%2FmxcT03w3nIfzKh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1df1b56a5-OSL

b464.m0rx1.com/90z5/

172.67.201.169

200 OK

103 B

URL User Request GET HTTP/2
b464.m0rx1.com/90z5/
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
HTML document text\012- HTML document, ASCII text, with no line terminators
Size
103 B (103 bytes)
Hash
339fe908b782d533a2dfcaf5ef04a529
1e791f0e3e0c1d1a04cbaddd817080dce64ba620
3370a1fe014eda4355e78696a1f9eec823fb9f12b485aab01397411a97ad05d8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /90z5/ HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ef7link.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 05 Dec 2023 13:39:11 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i8FnBlcBI3y4R5kn7UKNIJKfJ7XQLXZClQzstck2MSkUcVrTCMGDgD5ftfH5uYONz%2BEC0WGnXWWr5Bh0r5AdgPfXS41Ila4tJ94Gdfd5g59HEQVenq2SxScUvkFHOGn%2FLg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 830cb19abaf41c0a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

b464.m0rx1.com/web6/assets/pages/0a06.css?cb=1701783558124

172.67.201.169

200 OK

1.3 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/pages/0a06.css?cb=1701783558124
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text, with very long lines (1320), with no line terminators
Size
1.3 kB (1277 bytes)
Hash
f01289b3d1a61700b9be2f304ec9c8ba
e566c68bc2cd481307fe280f59e701e55ec2ae81
7233555de534a69a13ebd1e089834e8d4a6a360df6392bfe8345c31fb5a2437e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/pages/0a06.css?cb=1701783558124 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/css
last-modified: Thu, 30 Nov 2023 14:38:50 GMT
etag: W/"4fd-60b5f9c307e56-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tjsSuXtwKuU7q45XIZWkEjiWK67zAbJl1mTNXm87uWdWgw1PNQli9j7e4WK7g6Gt%2FhfEIU1udGr8FiN%2FuisMdvwbEsqjy1GOM3p5a2scA0obGysWT5VBqH2UF8Vx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 830cb1a19eae56a5-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal

104.17.2.184

200 OK

73 kB

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (40091)
Size
73 kB (72918 bytes)
Hash
39653c2754cfd36aa118549dc8e61be6
bbc7263a2fc20a69c67fd9473a0c289c26aeb8ae
ddcba4b01c6e37a58da84240078629b3c5b871ad2d4501c70a622254261b85a0

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 830cb1a268d55699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

code.jquery.com/jquery-3.6.0.min.js

151.101.130.137

200 OK

90 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65447)
Size
90 kB (89501 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 05 Dec 2023 13:39:11 GMT
age: 1180934
x-served-by: cache-lga21931-LGA, cache-bma1647-BMA
x-cache: HIT, HIT
x-cache-hits: 14, 315823
x-timer: S1701783552.612114,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

b464.m0rx1.com/web6/assets/fonts/GDSherpa-vf.woff2

172.67.201.169

200 OK

44 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/fonts/GDSherpa-vf.woff2
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0\012- data
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/fonts/GDSherpa-vf.woff2 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/90z5/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: font/woff2
content-length: 43596
last-modified: Thu, 24 Aug 2023 14:00:36 GMT
etag: "aa4c-603aba6faa900"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cy3OWkZ%2FXPBvE1BQl9FcoMU%2BkFuMjIoiBAkXZ0J5I3GpXbQziRpxGnApWTh3Gp2EdkorjD5Rr2iUesiIlD6iXyQqw16URUmLOQcHZLZgjpGx4tYWGMGEFpviwbUK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 8262
accept-ranges: bytes
server: cloudflare
cf-ray: 830cb1a1df1756a5-OSL

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/ew4g0I%2FZYomJh1e75pupA0WLfHDXy%2FQKEyLTEDfnNN8%3D

104.17.2.184

200 OK

61 B

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/ew4g0I%2FZYomJh1e75pupA0WLfHDXy%2FQKEyLTEDfnNN8%3D
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced\012- data
Size
61 B (61 bytes)
Hash
9246cca8fc3c00f50035f28e9f6b7f7d
3aa538440f70873b574f40cd793060f53ec17a5d
c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/cmg/1/ew4g0I%2FZYomJh1e75pupA0WLfHDXy%2FQKEyLTEDfnNN8%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: image/png
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 830cb1a35a1b5699-OSL
alt-svc: h3=":443"; ma=86400

b464.m0rx1.com/90z5/myscr948587.js

172.67.201.169

200 OK

28 kB

URL GET HTTP/3
b464.m0rx1.com/90z5/myscr948587.js
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text
Size
28 kB (27839 bytes)
Hash
798732c053c5578616e807f16f769d4f
cec3425b57280902e85f812358350362dad12799
a20b33ba5e7a21a1bd276fa6c94adda93e8b4e0daaf3770ef545a5f74295e334

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /90z5/myscr948587.js HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:11 GMT
content-type: application/javascript
last-modified: Thu, 30 Nov 2023 14:44:12 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 899
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E1T4qOR2wmeQz9nAwp8Tz6tJ1sInc9sMHfAdX4bDfnRke2LhLDcby0hiaEzSgNX0yOsP3yS%2F3LFY%2Bec1UNGnVImdnRcNoAuGvZoM9%2BPb377Wm051NYgs3cBqGZGEoTQ8rQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 830cb19d28e856a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

b464.m0rx1.com/web6/assets/js/pages-head-top-web.min.js?cb=1701783557614

172.67.201.169

200 OK

2.5 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/js/pages-head-top-web.min.js?cb=1701783557614
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text, with very long lines (2660), with no line terminators
Size
2.5 kB (2478 bytes)
Hash
e417733b0f3d442de78609400bcdbee8
1db75217530081f4e9f2886ced8e63d265abb8cc
175cb3eee4bb458355c82db9e7be199bddf6238116eda3b6ff13bf790d033d7c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/js/pages-head-top-web.min.js?cb=1701783557614 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/javascript
last-modified: Tue, 05 Dec 2023 00:09:12 GMT
etag: W/"9ae-60bb80b5ee41f-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KvDCyYoI5x3lL7zY6y%2BQf1mVsXA1Q%2F5qhDgAqRouEPq272vedlTNOg5%2B7XXCdATKXblbYJODNhnDmYh8GfTiHFjmtir8OpDtTvwQ5K3R6KMQIxiKw24U87N%2FTvMo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 830cb19e6a5856a5-OSL
content-encoding: br

b464.m0rx1.com/web6/assets/css/pages-godaddy.css?cb=1

172.67.201.169

200 OK

38 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/css/pages-godaddy.css?cb=1
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text, with very long lines (1437), with CRLF line terminators
Size
38 kB (38221 bytes)
Hash
0a40b289b9ecb589387f31cbd2807033
dbb02f7d438a952b55cab142749c648cd6417af5
c17e32e67edc46c2720b01a4a716996809ad8335c875f6980319a1440de6c245

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/css/pages-godaddy.css?cb=1 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/css
last-modified: Wed, 08 Nov 2023 20:47:39 GMT
etag: W/"954d-609aa32a9dca8-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8262
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fC0QCu9jtLekglDkC4pQYdGgYVcbrMfLFSNa05g0XE4ZuPpwgloG3tVN6NxM52QLxT16mHVWosIhebSfqFmZBUjX8yAr5%2Bv7QhbNnrjoqOpjflzHeJ7KseiwpqK2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 830cb1a1aebc56a5-OSL
content-encoding: br

b464.m0rx1.com/web6/assets/js/pages-head-web.min.js?cb=1

172.67.201.169

200 OK

9.5 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/js/pages-head-web.min.js?cb=1
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
ASCII text, with very long lines (9493), with no line terminators
Size
9.5 kB (9451 bytes)
Hash
452d55de561fffc8c0c96f698dbdf9a8
c2ea086b0040d100bf614cec061acd05d1537041
20c2e9dc4f093d70b78f5fb33c764d1d8afe53383de06a8a680b14dd07d613f4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/js/pages-head-web.min.js?cb=1 HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/javascript
last-modified: Thu, 23 Nov 2023 21:57:28 GMT
etag: W/"24eb-60ad8ebfd52c3-gzip"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8262
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qcBsOweKpfWNgQkT00gkbUi4IthOUt%2BhNyayMK2w8TYSM4T%2Bqt%2BcbDgxrHeHMM5FOIQ%2BZvIsxmNFEqxugQtvMul%2BVJn%2FM0q1JbbjIkQOUyKaRqC%2FOKZxVv9YsaSd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 830cb1a1beed56a5-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03

104.17.2.184

200 OK

18 kB

URL POST HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (17848), with no line terminators
Size
18 kB (17848 bytes)
Hash
d00c7399f41ce128cec694a78985154d
96c58ac270987037f6e2611c0853244e00620225
737bc16c6b52f68f7aabe94aa6a80c9fde662d5931ac5a4b79528981252f3d39

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 01d9e57d0c6dc03
Content-Length: 25291
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:14 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: MJQGQBHzJxma0ifqIkPITwg8xt3e6fA70ZfoTaIJdDjeV8Md4lSpTkBc8jIb/GRn$H6sEZh6wPZSsJUN8Ii0Cfw==
server: cloudflare
cf-ray: 830cb1b028225699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

104.17.2.184

302 Found

34 kB

URL GET HTTP/2
challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type

Size
34 kB (33876 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 05 Dec 2023 13:39:11 GMT
vary: accept-encoding
cache-control: max-age=300, public
location: /turnstile/v0/b/56d3063b/api.js?render=explicit
access-control-allow-origin: *
server: cloudflare
cf-ray: 830cb19d8cca712a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

b464.m0rx1.com/web6/assets/cloudfavicon.ico

172.67.201.169

200 OK

34 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/cloudfavicon.ico
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Size
34 kB (34494 bytes)
Hash
88415acda09a4cbd9d87543c3ba78180
2dec4705e9ab399efdc6eef36e079aa31d1df8d9
20cccc47c1bac9d2ef36b6a1c58af58c5c169ad5ca084080f0392b86f949641c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/cloudfavicon.ico HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:11 GMT
content-type: image/vnd.microsoft.icon
last-modified: Wed, 16 Aug 2023 01:22:46 GMT
etag: W/"86be-6030022068580"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8261
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M7P8DUUfrafgfMMcw4nkIxYE4EspI5AuS8hzqhvo6iwukasnqmoth%2BmKGVOAYSEkb%2Flzy7AHE5xME%2Fkd6nn3wpJH0eN9TPEqFHGSdYYoz47fqD%2FD2mnmzBbZElxg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 830cb19f1b5956a5-OSL
content-encoding: br

b464.m0rx1.com/web6/assets/cloudfavicon.ico

172.67.201.169

200 OK

34 kB

URL GET HTTP/3
b464.m0rx1.com/web6/assets/cloudfavicon.ico
IP
172.67.201.169:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerGoogle Trust Services LLC
Subjectm0rx1.com
Fingerprint18:E1:31:63:0D:C5:8C:BD:0F:2C:19:B8:F8:76:E4:2A:C4:A3:8A:1F
ValidityThu, 30 Nov 2023 13:22:35 GMT - Wed, 28 Feb 2024 13:22:34 GMT

File type
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Size
34 kB (34494 bytes)
Hash
88415acda09a4cbd9d87543c3ba78180
2dec4705e9ab399efdc6eef36e079aa31d1df8d9
20cccc47c1bac9d2ef36b6a1c58af58c5c169ad5ca084080f0392b86f949641c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /web6/assets/cloudfavicon.ico HTTP/1.1
Host: b464.m0rx1.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/90z5/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: image/vnd.microsoft.icon
last-modified: Wed, 16 Aug 2023 01:22:46 GMT
etag: W/"86be-6030022068580"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 8262
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M7P8DUUfrafgfMMcw4nkIxYE4EspI5AuS8hzqhvo6iwukasnqmoth%2BmKGVOAYSEkb%2Flzy7AHE5xME%2Fkd6nn3wpJH0eN9TPEqFHGSdYYoz47fqD%2FD2mnmzBbZElxg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 830cb1a3089056a5-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/830cb1a268d55699/1701783552906/48d05b4756afd79f10a1ada2dbb76cb4cdfb9fcdeb2b86b16b1916b88a12933f/yFkM7b4xRjOPLCr

104.17.2.184

401 Unauthorized

1 B

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/830cb1a268d55699/1701783552906/48d05b4756afd79f10a1ada2dbb76cb4cdfb9fcdeb2b86b16b1916b88a12933f/yFkM7b4xRjOPLCr
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
ff44570aca8241914870afbc310cdb85
58668e7669fd564d99db5d581fcdb6a5618440b5
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/pat/830cb1a268d55699/1701783552906/48d05b4756afd79f10a1ada2dbb76cb4cdfb9fcdeb2b86b16b1916b88a12933f/yFkM7b4xRjOPLCr HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 401 Unauthorized
date: Tue, 05 Dec 2023 13:39:13 GMT
content-type: text/plain; charset=UTF-8
www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gSNBbR1av158Qoa2i27dstM37n83rK4axaxkWuIoSkz8AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEApsOXvs4inomvHEEJWeAmbewj10vTdOMUJh5YooYpzkcTFx8O1fGckZDmN__WSsDanz_dK-uZ_ETYKIumajyX7F3zXM4AXeZC2iYL_e3-Pi1TmaGIMJZdPWVVC9cf8AFwX7fRkcgCHxky-BRBi2T8ry--e2NK119BZC3f1t7LwQTVpP1LL3UYxZNFWJTGISYzuWNO5NvmWgGr2V4bint7BqWVsBG5VguykSCXBQX0WyMxge5W5z-tspRPjpXtc35sgdq737t6ATIZ2BVH0nyYaECjgMbN-BY6w9Y_jz03Ce0StP3YSZijpo1lfW2_lIX3SvsNX-SYCOkZ-9685ZUBSQIDAQAB, max-age=20, PrivateToken challenge=AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIEjQW0dWr9efEKGtotu3bLTN-5_N6yuGsWsZFriKEpM_ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAyAcIyqXWj0XAym0z5V844rFA0WOzLVwj0uCwmVj6zC4qOH40oBiGHrMNMBnDyk95jvnBAuHeEs855e7nA4l4DPJ4jUWKZbua8BxGAzjn74A1BV81a52F1zvBPUm-VEJXPAPXQehXphSv51uR7HKtfcM5oaS33TGDSy-6xv0r84xjMuTBvwPgXGehxpi1MCGGE5yWkzKN5Zzllk7m6Nkiv6learV-Uz7tzaoPbdZkBk1bFXxm2q07jWavoBZ-JEuEJyjQ00PSTz2Zjpbct6AlR3eCS9sbmXtb5XxSs7JMsvoa8uojD7a5m2SEJIwaf8xKL6wtxkaPonUfvsLj4JoJZQIDAQAB, max-age=20
server: cloudflare
cf-ray: 830cb1aa09715699-OSL
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/830cb1a268d55699/1701783552910/4Rz3_n2pozLj0hH

104.17.2.184

200 OK

61 B

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/830cb1a268d55699/1701783552910/4Rz3_n2pozLj0hH
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
PNG image data, 62 x 25, 8-bit/color RGB, non-interlaced\012- data
Size
61 B (61 bytes)
Hash
4ef0e843cb9c341416a0d36013036fc6
a185f614d8b46cfd8e47be74b7cdcee18fd9a762
e66e86d99b881f975dfd49cc3188c6b9d892c608e242cb711cae2b5b85f932d2

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/i/830cb1a268d55699/1701783552910/4Rz3_n2pozLj0hH HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:13 GMT
content-type: image/png
server: cloudflare
cf-ray: 830cb1aa79ef5699-OSL
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03

104.17.2.184

200 OK

107 kB

URL POST HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
107 kB (107436 bytes)
Hash
da116da3501d69809df4401dc5702c72
d18a97de2d0b50a94a6195fd410736c6b16f7cc8
17b6886534104b71faf61832182ead70d39c14cd225c0b1261624a094409879e

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1335566572:1701781642:5zEiDI4mBxDLAxsSNslPOG11GWR50sEs4o4dEDVAEXk/830cb1a268d55699/01d9e57d0c6dc03 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 01d9e57d0c6dc03
Content-Length: 2364
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: 5j+BdCbCewlR1CcfMfq9qAT3um9aXoTdR3X0ljEh6bV8BzAMmO006xvt2dPtpRcxwt6GkGq6gjvrFDMBBFNxp9vNsbvgpZArDxjcOfZWugFu+rDagkCVmYNMWxQkt14SMF/PTEkOnN9Zqi9sgEN37MgcfxcylD+9tq4EyfUrKC8DoIjcILu2O7qsK+UjKV3E6Oz+hx+cwlVX1j8d4MV+2hcbB+ZcCYVYnrt6P0eRgLMLa7QIFvll/dG/fB+SK5csd3W3b1YBWFjhDXRwElZwFx4JcixO0neaeVB+iZOp8s2zSuHNpn9ITsy4PesXhP2lpZclKaOceCZxovQr02h5LljYQAROOgaplaII2JOUzHMstE4+peezyrvQ3ElL8dgzo+Spt1yu88wwSGm41AI0yTobbgwvJEFmVXOxwwz4njODT1Y3nwJBhDRTzO8cbFzk$hyVDPiQkeNmYQgp3m3JFvg==
server: cloudflare
cf-ray: 830cb1a59ca45699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

challenges.cloudflare.com/turnstile/v0/b/56d3063b/api.js?render=explicit

104.17.2.184

200 OK

34 kB

URL GET HTTP/2
challenges.cloudflare.com/turnstile/v0/b/56d3063b/api.js?render=explicit
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (33875)
Size
34 kB (33876 bytes)
Hash
8c90f391245a994ae95e644a587c8626
7bfc99336571d0ccfe38f9e1d18cb26b4adfc316
acbe221d9bb71e85d0a3b52a7a9d44ee4669ab664186b32d0c737a2be62681e7

HTTP Headers

GET /turnstile/v0/b/56d3063b/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://b464.m0rx1.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 05 Dec 2023 13:39:11 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 830cb19d9ce9712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdn.socket.io/4.6.0/socket.io.min.js

143.204.55.70

200 OK

46 kB

URL GET HTTP/2
cdn.socket.io/4.6.0/socket.io.min.js
IP
143.204.55.70:443
ASN
#16509 AMAZON-02

Requested by
https://b464.m0rx1.com/90z5/#charles@davidsonslawyers.com
Certificate
IssuerAmazon
Subjectcdn.socket.io
FingerprintBB:7D:4E:26:70:F6:06:2A:12:E9:92:A8:F1:9F:CD:82:0B:BF:48:ED
ValiditySun, 22 Oct 2023 00:00:00 GMT - Sun, 17 Nov 2024 23:59:59 GMT

File type
ASCII text, with very long lines (45667)
Size
46 kB (45806 bytes)
Hash
80f5b8c6a9eeac15de93e5a112036a06
f7174635137d37581b11937fc90e9cb325077bce
0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542

HTTP Headers

GET /4.6.0/socket.io.min.js HTTP/1.1
Host: cdn.socket.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://b464.m0rx1.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
content-disposition: inline; filename="socket.io.min.js"
content-encoding: gzip
date: Fri, 27 Oct 2023 10:49:06 GMT
etag: W/"80f5b8c6a9eeac15de93e5a112036a06"
server: Vercel
strict-transport-security: max-age=63072000
x-vercel-cache: HIT
x-vercel-id: fra1::bqgb5-1698403746025-0e8d119dc2bf
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: haC0ay94ReiUSYWwJdoyL46kZ3Baii41FIP7NuhX3lJXm5eARDcgJg==
age: 3769274
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=830cb1a268d55699

104.17.2.184

200 OK

171 kB

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=830cb1a268d55699
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
171 kB (170954 bytes)
Hash
6eb9b2ee3ee472f41dc7cc2cb1b339ce
be36ae7ea1f18cdd29b079a18ecf675594f47ae6
09d4068013ae9813ca7fd02cc6cd6d748dd59c61f6a80fd23170d0b5702e64ea

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=830cb1a268d55699 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/b6uwp/0x4AAAAAAAN6D7f9sgpQQzbS/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 05 Dec 2023 13:39:12 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server: cloudflare
cf-ray: 830cb1a35a1e5699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations