urlquery Phishing - Microsoft Outlook
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
https://sdfgroup.electronicstorefront.com/pricing/convert=342677a788854fd16d2e9db54e7f4d4f20260120201502&sig=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJak16TkRJMk56ZGhOemc0T0RVMFptUXhObVF5WlRsa1lqVTBaVGRtTkdRMFpqSXdNall3TVRJd01qQXhOVEF5QmpvR1JWUT0iLCJleHAiOm51bGwsInB1ciI6InBsdXNfY29udmVyc2lvbiJ9fQ%3D%3D--21b9aa73aee8618a0d84fd530c29fa2c23185b3e&trk=TRN_TER_02&trk_extra=ter%3Ag.polinder%40boeve.nl&utm_campaign=TRN_TER_02&utm_medium=email&utm_source=sendgrid
public
Phishing detected
Review evidence →3 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://sdfgroup.electronicstorefront.com/pricing/convert=342677a788854fd16d2e9db54e7f4d4f20260120201502&sig=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJak16TkRJMk56ZGhOemc0T0RVMFptUXhObVF5WlRsa1lqVTBaVGRtTkdRMFpqSXdNall3TVRJd01qQXhOVEF5QmpvR1JWUT0iLCJleHAiOm51bGwsInB1ciI6InBsdXNfY29udmVyc2lvbiJ9fQ%3D%3D--21b9aa73aee8618a0d84fd530c29fa2c23185b3e&trk=TRN_TER_02&trk_extra=ter%3Ag.polinder%40boeve.nl&utm_campaign=TRN_TER_02&utm_medium=email&utm_source=sendgrid
- Submitted IP / ASN
104.21.50.116 AS13335 · CLOUDFLARENET
- Final URL
- https://ssolive.ceritakala.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fonline-app.ceritakala.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARi6_ZNtoxWdVqrdETwlMycnlmMnPE5mWVglasYlQkbp3-BkfEFI-MtJkH_onTPlPBit9SU1KLEksz8vAssAq9YeAyYrTg4uAQYJBgUGH6wMC5iBdo69_H-OTO-ObjvsvlYU7WBh-EUq35BcXqRvkVaSrFlYI6zvpm3h2mgo36-d0FqYYh2sHmij4eFu49xmaevWWWoraWV4QQ2oQlsTKfYGD6wMXawM8xiZzjAybiBh_EAL8MPvqOr9tx8f3Hae49X_DrlUW5ehsZFlemlgSWhuSHGuSFhYW5BeQaVyVWmfmkuzuVelq5VPl45RZmBthsEGB4AkSDDD8GGBocOIQYA0&estsfed=1&uaid=93be7e5d5b394225ad22c411ca1c9c8c&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=suca%40gmail.com&login_hint=suca%40gmail.com
- Final IP / ASN
- 188.114.97.1 AS13335 · CLOUDFLARENET
Final page
- Page title
- Get a code to sign in
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 2.2 KB (2245 bytes)
Detections
Activity
- HTTP requests
- 42
- Observed hosts
- 11
- Script records
- 235
Estimated HTTP data
- Sent
- ~140.9 KB
- Received
- ~4.84 MB
Page capture
Final browser state
ssolive.ceritakala.com
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Suspicious - Suspicious Javascript code
VerdictSuspicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| df.cfp.microsoft.com | 83785 | 1991-05-02 | 2025-02-06 | 2026-01-22 | 1.0 KB | 2.5 KB |  20.62.60.180 | |
| fpt.live.com | 78827 | 1994-12-28 | 2017-01-31 | 2026-01-22 | 2.5 KB | 24.5 KB | 20.62.60.180 | |
| shared.whitelabelinbox.com 1 alerts | N/A | 2025-12-21 | 2025-12-23 | 2025-12-23 | 1.3 KB | 414.0 KB | 104.21.48.196 | PHP Programming languages PHP is a general-purpose scripting language used for web development. LiteSpeed Cache Caching, WordPress plugins LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress. LiteSpeed Web servers LiteSpeed is a high-scalability web server. Litespeed Cache Caching, WordPress plugins LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| portal.microsoftonline.com | 222862 | 2002-07-09 | 2014-01-23 | 2026-01-18 | 515 B | 1.8 KB | 150.171.73.13 | |
| challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2026-01-18 | 7.2 KB | 563.2 KB | 104.18.94.41 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| online-app.ceritakala.com 5 alerts | N/A | 2026-01-04 | 2026-01-23 | 2026-01-23 | 4.9 KB | 88.4 KB | 188.114.97.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| ssolive.ceritakala.com | N/A | N/A | N/A | N/A | 8.6 KB | 43.6 KB | 188.114.97.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| logincdn.msftauth.net | 23294 | 2018-10-25 | 2020-04-23 | 2026-01-21 | 2.7 KB | 2.14 MB |  2.22.225.34 | |
| cdn-2.ceritakala.com 6 alerts | N/A | 2026-01-04 | 2026-01-23 | 2026-01-23 | 3.0 KB | 1.19 MB | 188.114.96.1 | Azure PaaS Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Azure Front Door Load balancers Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications. |
| sdfgroup.electronicstorefront.com | N/A | 2020-03-07 | 2026-01-23 | 2026-01-23 | 2.9 KB | 414.5 KB | 188.114.96.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| browser.events.data.microsoft.com | 380 | 1991-05-02 | 2018-05-25 | 2026-01-21 | 1.4 KB | 1.1 KB | 20.189.173.25 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Microsoft HTTPAPI:2.0 Web servers Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security. |