WEBSITE ANALYSIS REPORT

https://www.google.com/url?q=https%3A%2F%2Fretrovideodanse.com%2Fq&sa=D&sntz=1&usg=AOvVaw3o1pARXjlLioe5CNWwhAz9#?a=bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292

02 Apr 2026 · 12:36:34.000 UTCpublic

Report tags: phishing microsoft outlook
Submit tags

Request review

Phishing detected

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

12:36:12.336 GET 200 document 343 B 328 ms —

12:36:12.747 GET No response img 0 B 0 ms —

12:36:12.866 GET 301 document 11.1 KB 388 ms —

12:36:13.246 GET 302 document 11.1 KB 239 ms —

12:36:13.488 GET 200 document 11.1 KB 210 ms —

12:36:13.812 GET 200 img 16.6 KB 9 ms —

12:36:21.023 POST 200 document 200.9 KB 930 ms 2 alerts

Transaction #12

Request / response

URL

POST HTTPS

https://red-bar-51da.toge4lvuvpskbb37059.workers.dev/0x69c69d7365324bb05a0a5b71/om/bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292

IP / ASN

188.114.97.1

AS13335 · CLOUDFLARENET

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with very long lines (65536), with no line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 02 Apr 2026 · 12:36:40.570 UTC
Last seen (UTC): 02 Apr 2026 · 12:36:40.570 UTC
Times seen: 1

Size: 200.9 KB (205708 bytes)
MD5: adc984b109f541f2fc3b8872e2053dce
SHA1: 363394bd8478ae2b7a6b62003eb52ca2a6d7bbdb
SHA256: 372cc91307417af867d98edd4cdf47acf436beb8c068e5172f4b304a3fda2ca2

Certificate information

Issuer: Google Trust Services · WE1
Subject: toge4lvuvpskbb37059.workers.dev
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 74:6C:7D:5E:AE:BB:EB:08:CC:34:15:BC:0A:79:FB:C9:E5:2D:58:6A
Valid from: Sun, 15 Mar 2026 19:20:53 GMT
Valid until: Sat, 13 Jun 2026 20:19:28 GMT

Technology fingerprints

Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft Outlook	medium	Phishing
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

POST /0x69c69d7365324bb05a0a5b71/om/bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292 HTTP/1.1
Host: red-bar-51da.toge4lvuvpskbb37059.workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 5
Origin: https://q.retrovideodanse.com
DNT: 1
Connection: keep-alive
Referer: https://q.retrovideodanse.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
date: Thu, 02 Apr 2026 12:36:21 GMT
content-type: text/html; charset=utf-8
cf-ray: 9e5fe0efbee4a0f0-OSL
cf-cache-status: DYNAMIC
access-control-allow-origin: https://q.retrovideodanse.com
cache-control: public, max-age=3600
server: cloudflare
set-cookie: buid=1.AUYAqzBRR7ViQUKp00fjfJvCFakreHKQRANPjYJWI3DqNWYAAABGAA.AQABGgEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzAwAAAAAAEZdU1uSrxbhHAH4pQxbVuxtHe4m0DbBSaHGcppZre_AccO0TV_Ox47kvaz7Euh_k4LSHKAP3WMRhe2l-s27sm0ebmAulFWPtjmo-q_HZPucgAA; path=/
esctx=PAQABBwEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAr-eYwB1cW-sL8SeFOXZdjM4W47Q51gZRvIKwVLcyY1uLmrjRYe4-BUOL9_ZM5UT9HVObQPu0b6TM9Rx4NEdzWDtPVfD-CgnAj-nlt-nR4soHP8CcTOnbeisXnBAiiIRBJ98MGCNUbpqBaqJw0nrzjXCNsS5rup6z-tKih2Pe5PYgAA; path=/
esctx-xczsUkKVLbQ=AQABCQEAAACvnsHKEvvRQb3Bz3Qc7wnaRXZvU3RzQXJ0aWZhY3RzDQAAAAAAo08XJnSqcN0bP1Cm5V3wm-kG9PZYf11R2zRwM7nZ_s5cry1yciND9N3meDc8EpgomYUki2N_FpWVFl-y75tE4pN4ZAgoXoKXlDFfingSi-vP1r4NZsfptOz1a384QNmyIfrcvCAcmtt7rSCWSBUG5SAA; path=/
fpc=Al5aGhtQGYNEqkWhogRtzEi4vjNwAQAAAMVZYOEOAAAA; path=/
x-ms-gateway-slice=estsfd; path=/
stsservicecookie=estsfd; path=/
appdfmd5naosiz309213=bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292; path=/
vary: Origin, accept-encoding, Origin
access-control-allow-credentials: true
access-control-allow-headers: Cookie, x-kpsdk-v, auth,authkey , authvalue, Authorization, User-Agent, Keep-Alive, Content-Type, X-Requested-With
access-control-allow-methods: GET, POST, DELETE, PUT, PATCH, OPTIONS
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BzFK08t8126vXDjbgOHZapq9oNXDQ8L5IQuAi3Iky0JYKsFFYlTuErwh5FRoePD3%2BVWfglgckF8FBzpHL4wTXiFJXcruVMs%2FkmZ3Jgh7n%2B%2B5rY6f2SPE1IQzjAj6KlJMNXFeeA8LvYfZLaVU%2BETlJiNhg6vhXw%3D%3D"}]}
reporting-endpoints: coop-endpoint="https://idux.azurewebsites.net:443/api/coopReport?client_type=none-none&client_id=https%3a%2f%2fportal.microsoftonline.com.orgid.com&correlation_id=e393a07b-7dfd-45ed-8137-d2a1da066083&tenant=475130ab-62b5-4241-a9d3-47e37c9bc215"
x-ms-ests-server: 2.1.23834.3 - EUS ProdSlices
x-ms-request-id: 254c0a34-e481-49ab-a9b3-119ac2691400
x-ms-srs: 1.P
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Request body

Captured 5 B · Displayed 5 B

line=

12:36:22.041 GET 200 stylesheet 111.5 KB 288 ms —

12:36:22.049 GET 200 script 60.3 KB 271 ms —

12:36:22.346 GET 200 script 185.7 KB 5 ms —

12:36:22.457 GET 200 script 397.9 KB 7 ms —

12:36:22.527 GET 404 subdocument 1.2 KB 600 ms —

12:36:22.722 GET 200 img 45.5 KB 3 ms —

12:36:22.732 GET 200 img 3.6 KB 2 ms —

12:36:22.753 GET 200 script 111.1 KB 3 ms —

12:36:23.056 GET 200 img 1.6 KB 2 ms —

https://www.google.com/url?q=https%3A%2F%2Fretrovideodanse.com%2Fq&sa=D&sntz=1&usg=AOvVaw3o1pARXjlLioe5CNWwhAz9#?a=bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292

Domain graph

Hostnames

Connections

Network requests

Transaction #12

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>https://www.google.com/url?q=https%3A%2F%2Fretrovideodanse.com%2Fq&sa=D&sntz=1&usg=AOvVaw3o1pARXjlLioe5CNWwhAz9#?a=bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #12

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Request body

https://www.google.com/url?q=https%3A%2F%2Fretrovideodanse.com%2Fq&sa=D&sntz=1&usg=AOvVaw3o1pARXjlLioe5CNWwhAz9#?a=bWVyZWRpdGguc2NocmFtQG1lZGljYWlkLm9oaW8uZ292

Domain graph

Network requests