{"report_id":"bc66b91d-0146-4cc7-9b26-55a1f71dc3a5","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-09-19T22:00:33Z","url":{"schema":"http","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":0,"asn":19871,"as":"Network Solutions, LLC","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"title":"Sign in to Outlook","dom":{"size":2686,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"c19a7d97d910bda973d0f88d3185b65b","sha1":"f35e1dc524a45f2a9f8e2348b288a7b1f3ecc98e","sha256":"93feae3dd802013d46022ece5225001e5ec0c8fcf1301482e65577a21303ad4c","sha512":"a4e345c9f91e7e72084a3d59643c474db8b46c36f3d684755d7c1d7eea7f2de86459a9d164f8f00346b306f1c4b728b84f16f47526c4161a163ad122427ad4ac","ssdeep":"","tlshash":"58512088ace330183497016c4bef245891b2941b264cc46cbc0cdb55ef69ab555ab9df","dom_hash":"domhasha3587a81513907154e5202abb4a9b95b","first_seen":"2025-11-14T22:09:34.614823Z","last_seen":"2026-09-19T22:00:33.861226Z","times_seen":14,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":0,"asn":19871,"as":"Network Solutions, LLC","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-24T22:00:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"wildcard.hanefra7bikiemta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"wildcard.hanefra7bikiemta.com","ip":{"addr":"192.185.151.7","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"domain_registered":"2018-09-08","domain_rank":0,"first_seen":"2023-08-14T00:44:17Z","last_seen":"2026-09-19T21:52:06.227679Z","alert_count":10,"request_count":2,"received_data":14967,"sent_data":1032,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"introduction_type":"eventHandler","is_inline":false,"md5":"407f3ff7b9c17f54041cc48c8a444f62","sha1":"b8c589b12fc61c80713baf2c45b6084d8bbeca5d","sha256":"9f656480c578a9bbf209226855a213ec3aaa9e282b322e1265c2f3cfb96dce20","sha512":"2d42a45d98c3d3148b9211c7bc3f313348c0e46ae8f9ed98390c77fd41d624e7401827bf57041d9e6c853b124833a3b3d43e1341650101bb5a772a164c350dc7","ssdeep":"","tlshash":"6240000030000000000003c000000000c00000c0030000c000c0003000000000000000","size":7,"data":"","first_seen":"2023-04-14T00:25:51Z","last_seen":"2026-09-19T22:00:33.863277Z","times_seen":625,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"dcd2c2c57264e08b506c2d1bf5c1817c","sha1":"869eae2481d30d0da3223ff321cf7d0d3656ca62","sha256":"25b5855d5227376516e830749a4d66a7429ac97567ec1e018c02ae3f8efd30e2","sha512":"d585e9599bfd93bcc742bb7082f0890ce0b2734030cc57cfe337ce081ae736aa6a25ef21841bd8e815aa8a29ea5a6fad4f9beb57121d343c4cad70cedff6c759","ssdeep":"","tlshash":"d15131886ce331183897117c4faf1018a0b2941b264dc42cbc0c9b44ff6da7655bbacf","size":2461,"data":"","first_seen":"2026-06-09T02:47:31.617845Z","last_seen":"2026-09-19T22:00:33.863872Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"map[actor:server1.conn0.watcher17.process7//obj21 class:HTMLAnchorElement contentDomReference:map[browsingContextId:3 id:0.4974218634512134] extensible:true frozen:false isError:false ownPropertyLength:0 preview:map[attributes:map[href:https://wildcard.hanefra7bikiemta.com/] attributesLength:1 isConnected:false kind:DOMNode nodeName:a nodeType:1] sealed:false type:object]","filename":"https://wildcard.hanefra7bikiemta.com/","line_number":44,"column_number":25},{"level":"log","text":"map[actor:server1.conn0.watcher17.process7//obj22 class:Array extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[items:[https://wildcard.hanefra7bikiemta.com/] kind:ArrayLike length:1] sealed:false type:object]","filename":"https://wildcard.hanefra7bikiemta.com/","line_number":58,"column_number":25}]},"http":[{"url":{"schema":"https","addr":"wildcard.hanefra7bikiemta.com/","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-19T22:00:05.011Z","timestamp":1789855205011,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.hanefra7bikiemta.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 15:34:02 GMT","end":"Wed, 28 Oct 2026 15:34:01 GMT"},"fingerprint":{"sha1":"00:20:30:D5:98:9D:1B:84:36:2B:C4:C1:4C:B8:A5:B9:3A:D3:25:E7","sha256":"F4:9D:F2:75:97:EA:49:5F:70:1B:60:F4:8C:79:70:5B:EF:FE:01:C3:C5:3E:A3:34:21:A0:10:A3:EC:CC:21:90"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: wildcard.hanefra7bikiemta.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 1076\r\ncontent-type: text/html; charset=UTF-8\r\ndate: Sat, 19 Sep 2026 22:00:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":2704,"size_decoded":1273,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text","md5":"3d8f42c32c6487fd859319bf7138e271","sha1":"bcdbeeccd66b10adb2d7f8186f33b53bef6a86d5","sha256":"04be86c463fe3424e9b4502909d406dffadbceb765116825e3fad92393908c6c","sha512":"1ad5301d447ab519aa17dfbece18edd23d3c000620ba185cea5246cfb040ef5674ad4284841a4babfc5d3911937bfccd0c95be3c85118293988c13328dc7d678","ssdeep":"","tlshash":"345120886ce330183497016c4bef2458a1b3941b264cc46cbc4cdb55ff69bb565abadf","first_seen":"2023-08-13T12:07:09Z","last_seen":"2026-09-19T22:00:33.862008Z","times_seen":250,"resource_available":true,"data":null}},"time_used":329,"timings":{"blocked":-1,"dns":6,"connect":102,"send":0,"wait":115,"receive":0,"ssl":106},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"wildcard.hanefra7bikiemta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"wildcard.hanefra7bikiemta.com/favicon.ico","fqdn":"wildcard.hanefra7bikiemta.com","domain":"hanefra7bikiemta.com","tld":"com"},"ip":{"addr":"192.185.151.7","port":443,"asn":19871,"as":"NETWORK-SOLUTIONS-HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://wildcard.hanefra7bikiemta.com/","date":"2026-09-19T22:00:05.555Z","timestamp":1789855205555,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.hanefra7bikiemta.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 30 Jul 2026 15:34:02 GMT","end":"Wed, 28 Oct 2026 15:34:01 GMT"},"fingerprint":{"sha1":"00:20:30:D5:98:9D:1B:84:36:2B:C4:C1:4C:B8:A5:B9:3A:D3:25:E7","sha256":"F4:9D:F2:75:97:EA:49:5F:70:1B:60:F4:8C:79:70:5B:EF:FE:01:C3:C5:3E:A3:34:21:A0:10:A3:EC:CC:21:90"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: wildcard.hanefra7bikiemta.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://wildcard.hanefra7bikiemta.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nlast-modified: Wed, 11 Mar 2026 02:24:50 GMT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 4677\r\ncontent-type: text/html\r\ndate: Sat, 19 Sep 2026 22:00:05 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"jQuery:3.3.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}],"data":{"size":11816,"size_decoded":4927,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (358)","md5":"a8063bd37d3c8fb3176a6bf140558a4d","sha1":"e32cf4b407db3d3773ded13ff64b70fdbad7735f","sha256":"bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482","sha512":"82d749f6b17b21587fb345ca196a2aa83eca80ad66ed9c1ab88b36709bed14175d53afefe9acc0dafc4fad78ffb8df155193a6829bc857ad6d68b1c84af7b854","ssdeep":"192:bpvXn2H25Zx48DNYGu6C9tdDOxktft1zQOPtaUrzvHlPuPQXGuV27BHplXtAUU/s:FvX2H25v4CYn6etFTBvhtv4IcpRtlU/s","tlshash":"bd32940bab4c063b1312459a7458639a370fc87fe2661bb474bfc06867d16a649f23dc","first_seen":"2023-04-05T03:58:47Z","last_seen":"2026-09-20T14:03:41.014725Z","times_seen":16581,"resource_available":true,"data":null}},"time_used":105,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-19","alert":"Phishing Block","trigger":"wildcard.hanefra7bikiemta.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-19","alert":"Sinkholed","trigger":"wildcard.hanefra7bikiemta.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}