WEBSITE ANALYSIS REPORT

http://p7v3w.airodyneqwerty.top/2743248b60dc

04 Sep 2026 · 14:51:59.000 UTCpublic

Report tags: microsoft phishing evilginx aitm outlook
Submit tags

Request review

Phishing detected

15 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

14:51:23.004 GET 200 document 1.89 MB 1983 ms 4 alerts

14:51:27.637 GET 302 document 0 B 734 ms 4 alerts

14:51:28.376 GET 302 document 0 B 791 ms 3 alerts

14:51:29.172 GET 200 document 60.9 KB 1237 ms 5 alerts

Transaction #20

Request / response

URL

GET HTTPS

https://office.airodyneqwerty.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639241302888833983.ZGViMjU2OGUtZTA4My00NjQ3LTkxZDYtOGZkNTdiZjU3YTJhYzhiMWRiZDYtMDY1NS00Mzc1LWFjZTItYTBmYzUxNGExM2Vh&ui_locales=en-US&mkt=en-US&client-request-id=1144c515-388d-42c6-bf66-6616bf168a7c&siwa=1&siwg=1&state=FPLnGFYbYpEG7Z0Y4AAb3v7pdENV0rYQxu3Zyk3tDCjyrYyb7wh0y7NxIUQTnEMQnh8U4HBEB3hVJPdL48ApuWyp55ucLYPZvLokAc9EPNb4vcMoXnHLKto4K1jg7qkgzeEwtebY8vx3z9CPNZ7gGZVTtuTG2auEGdfyw_Jiue0juAzhfg6bQCstlfsDIBdsaD8pNJT5Cswa0zQ4BNehymbhwh92aE9RG-zNKAFDoIDRjFGlBYskgh97oRW2dzqxVL2fJ0j-_yKT6AB6PjvxuL4I2lkglyrLzwv2SVjNor9D-d1mRv0coEwxJMLZP8KgmdLUMQI9Qij3LLZySIqE26hTbqdcBywDjYtH7HWzRFCQa-5v5kicgmiMEmsS7Mau4qUBY7v0v2Kha4Q3vLwUKBSw7Rk4uS-rLKB2s4T6e5MaGTPAaFdqLXkznElRBKbZ&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

IP / ASN

18.142.249.243

AS16509 · AMAZON-02

Requested by: Not recorded

Resource information

File type: HTML document, Unicode text, UTF-8 text, with very long lines (40087), with CRLF, LF line terminators
MIME type: text/html; charset=utf-8
First seen (UTC): 04 Sep 2026 · 14:52:06.755 UTC
Last seen (UTC): 04 Sep 2026 · 14:52:06.755 UTC
Times seen: 1

Size: 60.9 KB (62316 bytes)
MD5: 07afc94d86f4f11ae114fdfb0b088c9d
SHA1: 2a62a278cfe2d7195b9da114c60a3924536f322e
SHA256: 0ddead3101b8a81c910fe9b51f555059a05c199daaf280d9e324eb124dd61823

Certificate information

Issuer: ZeroSSL GmbH · ZeroSSL ECC DV SSL CA 2
Subject: airodyneqwerty.top
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: E2:2A:68:D9:F4:FD:23:D6:59:E7:41:6B:13:D9:22:D3:E9:42:56:9C
Valid from: Mon, 17 Aug 2026 00:00:00 GMT
Valid until: Sun, 15 Nov 2026 23:59:59 GMT

Technology fingerprints

Apache HTTP Server (Web servers)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft	medium	Phishing
urlquery Phishing - Evilginx MitM Proxy	high	Phishing
urlquery Phishing - Microsoft Outlook	medium	Phishing
OpenDNS Phishing Block	medium	Phishing
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639241302888833983.ZGViMjU2OGUtZTA4My00NjQ3LTkxZDYtOGZkNTdiZjU3YTJhYzhiMWRiZDYtMDY1NS00Mzc1LWFjZTItYTBmYzUxNGExM2Vh&ui_locales=en-US&mkt=en-US&client-request-id=1144c515-388d-42c6-bf66-6616bf168a7c&siwa=1&siwg=1&state=FPLnGFYbYpEG7Z0Y4AAb3v7pdENV0rYQxu3Zyk3tDCjyrYyb7wh0y7NxIUQTnEMQnh8U4HBEB3hVJPdL48ApuWyp55ucLYPZvLokAc9EPNb4vcMoXnHLKto4K1jg7qkgzeEwtebY8vx3z9CPNZ7gGZVTtuTG2auEGdfyw_Jiue0juAzhfg6bQCstlfsDIBdsaD8pNJT5Cswa0zQ4BNehymbhwh92aE9RG-zNKAFDoIDRjFGlBYskgh97oRW2dzqxVL2fJ0j-_yKT6AB6PjvxuL4I2lkglyrLzwv2SVjNor9D-d1mRv0coEwxJMLZP8KgmdLUMQI9Qij3LLZySIqE26hTbqdcBywDjYtH7HWzRFCQa-5v5kicgmiMEmsS7Mau4qUBY7v0v2Kha4Q3vLwUKBSw7Rk4uS-rLKB2s4T6e5MaGTPAaFdqLXkznElRBKbZ&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0 HTTP/1.1
Host: office.airodyneqwerty.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://p7v3w.airodyneqwerty.top/
Sec-GPC: 1
Connection: keep-alive
Cookie: 8dd7-2d51=3732189100feab46ef0d0884c7e2972e278bffa0bc9b485336e2847e4dbd5e0a
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Connection: close
Content-Type: text/html; charset=utf-8
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"
Date: Fri, 04 Sep 2026 14:51:29 GMT
Expires: -1
Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Reporting-Endpoints: coop-endpoint="https://coop.msauth.net:443/api/coopReport?client_type=web-msal&client_id=4765445b-32c6-49b0-83e6-1d93765276ca&correlation_id=1144c515-388d-42c6-bf66-6616bf168a7c&sku=IdNet&version=8.16.0&is1p=1"
Server: Apache
Set-Cookie: buid=1.AQoAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoAAAAKAA.AQABGgEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzAwAAAAAADCWFsG8dllBKP945XxEMBQJrt9bvNsYY52siw2pbpJkdhqZBjy8sx7Wsc-TRNSXw9hqNRzeWRNHA6iphtqujggfoLOokp0TB-KGgMADRWU4gAA; Path=/; Expires=Sun, 04 Oct 2026 14:51:29 GMT; HttpOnly; Secure; SameSite=None
esctx=PBgABBwEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzDQAAAAAAorw_NCQ0bjbYUNtswrWPvYxXL8lTqHBTPXMk26DDqQgtUv5LqWC6O9u1lGIFuiIzuskFCCPfAJCk6hWGzCB2IhMucLgDzk4xnzEk0tKSS_jCCIjS_ntMZkmTZcE3QDAtYyeZ478DDA2ONs0-elIBgWvPLdIBqAExq1tFeMfuEzsUDUafd0C7XZ9D4YsoQ3TenLRycsOmGzXMDPJtQrhhmrw0fPbRfsDjJrE2Z4WdqHeX_nFvD6pQ4dITPzs6sxFB_SOk94BXEjeSnhYMlj-rOFO_Or1OVad89uZWsyhWHEonEQ7k3fLtUP-jvrO4SANtTJImkW4L0B8xXOQQwigPPv1LFmU3T0RCjGbzYoeNpD13q0HSk-SNbxmu38yRyqwA8-ufY7CbzQtTjbjmGEx50JGX4rhw61YEirs1hoDdtc8ORn45bLiJBCIxL6AM8ArZ8pYvz7Q_s1ozA0vWhb9mSsoFD2ROeu4keLkUrneFwlchGst3ccZ51RqWtjucbo3E9GqqWOSpLZzb3CpRm5tpZhofOIyfb_gRwdaV7NuKCmILUnUpwiTF1-pO3uF3Xg4q8vb-8uFh7AMXpoyXeN-WQuFsh7Ew07YWh0G3GVmBjNYsp-urD0NLGyPV7Qjiy9sjW-dPucsaRafq0Nkz5tvzBuIN44mJg__gw8f4gAuXoi_kl6rrBB8nJsUfkHhqmAHac0RFKCV2AOLgAvv-sjvKpPiBW3fFuhIAkleaeZZ7Ig8gAA; Path=/; Domain=office.airodyneqwerty.top; HttpOnly; Secure; SameSite=None
esctx-6LyStqkUv10=AQABCQEAAAAdDD7nC9b5Q7JPd_okEQRFRXZvU3RzQXJ0aWZhY3RzDQAAAAAA-mTZ9OwWQThq0A00XSV3P30gDrE59Hae2riIpV7_V3n47BuN0ITBfO9X3o5yuCQ87drOQ7gl8Ljks0Udzb8wjcXCCeyV-OQ-KGH_vbJomnvdLgcSuaQ8oVUd595VqyymD-0K_Nrhe2DIIIxDJFej1iAA; Path=/; Domain=office.airodyneqwerty.top; HttpOnly; Secure; SameSite=None
fpc=AjIZogDiD_RHlwe36VK5Od68Ae7AAQAAAPDRLOIOAAAA; Path=/; Expires=Sun, 04 Oct 2026 14:51:29 GMT; HttpOnly; Secure; SameSite=None
x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=None
stsservicecookie=estsfd; Path=/; HttpOnly; Secure; SameSite=None
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Dns-Prefetch-Control: on
X-Ms-Clitelem: 1,50058,0,,
X-Ms-Ests-Server: 2.1.25158.8 - KRC ProdSlices
X-Ms-Request-Id: 0ca4346d-8aac-4966-b089-47ce00139000
X-Ms-Srs: 1.P

14:51:30.415 GET 200 stylesheet 111.5 KB 1183 ms 3 alerts

14:51:30.417 GET 200 script 575.4 KB 1580 ms 3 alerts

14:51:30.418 GET 200 script 60.8 KB 1083 ms 3 alerts

14:51:30.420 GET 200 script 6.9 KB 736 ms 5 alerts

14:51:30.422 GET 200 script 0 B 570 ms 5 alerts

14:51:32.061 GET 200 script 185.6 KB 1392 ms 3 alerts

14:51:32.070 GET 200 script 116.8 KB 1197 ms 3 alerts

14:51:32.272 GET 200 img 16.8 KB 811 ms 3 alerts

14:51:33.292 GET 200 script 11.7 KB 852 ms 3 alerts

14:51:34.152 GET 200 script 9.2 KB 820 ms 3 alerts

14:51:34.990 GET 200 script 399.0 KB 1654 ms 3 alerts

14:51:35.075 POST 200 xhr 293 B 767 ms 5 alerts

14:51:36.739 GET 200 script 15.4 KB 804 ms 3 alerts

14:51:36.747 GET 200 img 2.6 KB 802 ms 3 alerts

14:51:36.748 GET 200 img 3.5 KB 879 ms 3 alerts

14:51:37.607 GET 200 img 45.5 KB 1006 ms 3 alerts

14:51:37.609 GET 200 img 3.6 KB 812 ms 3 alerts

14:51:37.633 GET 200 subdocument 3.4 KB 1047 ms 3 alerts

14:51:39.152 GET 200 img 1.6 KB 815 ms 3 alerts

14:51:39.155 GET 200 img 1.4 KB 813 ms 3 alerts

14:51:39.157 GET 200 img 932 B 888 ms 3 alerts

14:51:40.796 POST 200 xhr 28.1 KB 1157 ms 5 alerts

http://p7v3w.airodyneqwerty.top/2743248b60dc

Domain graph

Hostnames

Connections

Network requests

Transaction #20

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://p7v3w.airodyneqwerty.top/2743248b60dc

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #20

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://p7v3w.airodyneqwerty.top/2743248b60dc

Domain graph

Network requests