Report - pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html

Report Overview

Submitted URL
pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
IP
104.18.3.35
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-24 05:57:34
Access
public
Website Title
Outlook Web Access - Secure Login
Final URL
pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
6

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
stackpath.bootstrapcdn.com	2467	2012-05-25	2018-06-15	2024-04-22	546 B	32 kB	104.18.10.207
pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev	unknown	2022-08-23	2023-06-06	2024-03-22	513 B	17 kB	104.18.3.35
c.s-microsoft.com	10166	2012-02-07	2013-11-06	2024-04-23	1.2 kB	64 kB	2.18.173.151
ow2.res.office365.com	10876	2005-06-20	2018-11-10	2024-03-22	491 B	34 kB	95.101.10.144
maxcdn.bootstrapcdn.com	724	2012-05-25	2014-06-18	2024-04-23	537 B	122 kB	104.18.10.207

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-23	medium	pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html	Outlook

PhishTank

Scan Date	Severity	Indicator	Alert
2023-06-08	medium	pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html	Other

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-24	medium	pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html	41 B	2023-03-07	2024-05-05
Pretty URL pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html IP 104.18.3.35 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:03 Last Seen2024-05-05 17:19:03 Times Seen7196 Hash 2ec370ca0eaf3069dce13df24243d863 64c1919bbb18a6d851d1b7772f830320b8ab5cc1 6a31a3a39783d09cc53dd9e9baeb4a4fa49be602eef90f6bbb9f78af02688064 Loading...

		Size	First Seen	Last Seen
	#1 Write - 07811dc6c422334ce36a09ff5cd6fe71	4 B	2023-03-11	2024-05-05
Pretty Observations First Seen2023-03-11 11:15:57 Last Seen2024-05-05 21:16:12 Times Seen2156 Hash 07811dc6c422334ce36a09ff5cd6fe71 7e79a3af2634de6635e59c9404d251b3955d39f9 6557739a67283a8de383fc5c0997fbec7c5721a46f28f3235fc9607598d9016b Loading...

HTTP Transactions (6)

URL IP Response Size

pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html

104.18.3.35

200 OK

17 kB

URL User Request GET HTTP/1.1
pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
IP
104.18.3.35:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subject*.r2.dev
Fingerprint48:74:F0:98:E0:A1:57:3E:86:18:BF:B3:DC:C9:7A:5B:53:50:FE:E0
ValidityFri, 05 Apr 2024 15:25:24 GMT - Thu, 04 Jul 2024 15:25:23 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (6870), with CRLF line terminators
Size
17 kB (17117 bytes)
Hash
3a17094d2e290d34425bb9176d203c11
5cec9653602c8e7f52d1a6e82f3132a9d6b89d0d
928deab03447edb4276fb709195477943eddf88f6a73d6c127cf0edcf9f284ce

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Outlook
PhishTank	phishing	Other
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /OWAOutlook.html HTTP/1.1
Host: pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 05:57:10 GMT
Content-Type: text/html
Content-Length: 17117
Connection: keep-alive
Accept-Ranges: bytes
ETag: "3a17094d2e290d34425bb9176d203c11"
Last-Modified: Tue, 06 Jun 2023 18:13:03 GMT
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8793daac9cd0b509-OSL

c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2

2.18.173.151

200 OK

29 kB

URL GET HTTP/2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2
IP
2.18.173.151:443
ASN
#16625 AKAMAI-AS

Requested by
https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Certificate
IssuerMicrosoft Corporation
Subjectwww.microsoft.com
FingerprintE1:57:9B:A5:51:25:CE:C3:A7:8E:39:F5:5C:F8:1D:A8:BF:A9:4F:88
ValidityThu, 14 Sep 2023 17:24:20 GMT - Sun, 08 Sep 2024 17:24:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29388, version 0.0
Size
29 kB (29388 bytes)
Hash
6e75a94d5f7170a1ab532d32c2a35755
9c1b6fff544089941bbeddbcf529c3f0b46d853a
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

HTTP Headers

GET /static/fonts/segoe-ui/west-european/semibold/latest.woff2 HTTP/1.1
Host: c.s-microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 29388
content-type: font/woff2
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
accept-ranges: bytes
etag: "5b68d583e9c7d51:0"
cache-control: public, max-age=133783
expires: Thu, 25 Apr 2024 19:06:53 GMT
date: Wed, 24 Apr 2024 05:57:10 GMT
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2

2.18.173.151

200 OK

34 kB

URL GET HTTP/2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
IP
2.18.173.151:443
ASN
#16625 AKAMAI-AS

Requested by
https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Certificate
IssuerMicrosoft Corporation
Subjectwww.microsoft.com
FingerprintE1:57:9B:A5:51:25:CE:C3:A7:8E:39:F5:5C:F8:1D:A8:BF:A9:4F:88
ValidityThu, 14 Sep 2023 17:24:20 GMT - Sun, 08 Sep 2024 17:24:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 34052, version 0.0
Size
34 kB (34052 bytes)
Hash
36397a3bc139c6e9f81d383f060f080a
3f4f86c10920d4ed345f4858b6cde9f93e1aeb81
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

HTTP Headers

GET /static/fonts/segoe-ui/west-european/normal/latest.woff2 HTTP/1.1
Host: c.s-microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 34052
content-type: font/woff2
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
accept-ranges: bytes
etag: "588d483e9c7d51:0"
cache-control: public, max-age=153619
expires: Fri, 26 Apr 2024 00:37:29 GMT
date: Wed, 24 Apr 2024 05:57:10 GMT
access-control-allow-methods: GET,POST
access-control-allow-origin: *
X-Firefox-Spdy: h2

ow2.res.office365.com/owalanding/2020.1.16.01/images/favicon.ico?v=4

95.101.10.144

200 OK

33 kB

URL GET HTTP/2
ow2.res.office365.com/owalanding/2020.1.16.01/images/favicon.ico?v=4
IP
95.101.10.144:443
ASN
#20940 Akamai International B.V.

Requested by
https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Certificate
IssuerDigiCert Inc
Subject*.res.outlook.com
Fingerprint21:55:DF:8C:D8:DA:80:F2:04:7A:B9:66:BA:AC:C0:DC:D7:DB:46:D5
ValidityTue, 20 Feb 2024 00:00:00 GMT - Thu, 20 Feb 2025 23:59:59 GMT

File type
MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Size
33 kB (32847 bytes)
Hash
0f25f5fac71cfc393ee63c564eae4140
9d4484be62c2b169d45d70b4ac7aa24beb45df0e
7a480a157538b13126374ce380424a933bdffbc1c162aa0479e6c9e1de37be90

HTTP Headers

GET /owalanding/2020.1.16.01/images/favicon.ico?v=4 HTTP/1.1
Host: ow2.res.office365.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 32847
content-type: image/x-icon
last-modified: Fri, 17 Jan 2020 00:12:17 GMT
x-ms-request-id: e19d765f-e01e-0054-736a-8a8596000000
cache-control: max-age=630720000
date: Wed, 24 Apr 2024 05:57:11 GMT
alt-svc: h3=":443"; ma=93600
akamai-request-bc: [a=95.101.10.140,b=23872229,c=g,n=NO__OSLO,o=20940],[c=p,n=NO__OSLO,o=20940]
report-to: {"group":"NelM365CDNUpload1","max_age":604800,"endpoints":[{"url":"https://M365CDN.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=OSLO&ASN=20940&Country=NO&Region=&RequestIdentifier=0.8c0a655f.1713938231.16c42e5&TotalRTCDNTime=2&CompressionType=&FileSize=32847"}],"include_subdomains ":true}
nel: {"report_to":"NelM365CDNUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
server-timing: clientrtt; dur=2, clienttt; dur=30, origin; dur=0 , cdntime; dur=30
akamai-cache-status: Miss from child
timing-allow-origin: *
access-control-expose-headers: date,Akamai-Request-BC,X-Cdn-Provider,X-Ms-Request-Id
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains
x-cdn-provider: Akamai
X-Firefox-Spdy: h2

maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

104.18.10.207

200 OK

121 kB

URL GET HTTP/2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
IP
104.18.10.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
ASCII text, with very long lines (65371)
Size
121 kB (121200 bytes)
Hash
ec3bb52a00e176a7181d454dffaea219
6527d8bf3e1e9368bab8c7b60f56bc01fa3afd68
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

HTTP Headers

GET /bootstrap/3.3.7/css/bootstrap.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 24 Apr 2024 05:57:10 GMT
content-type: text/css; charset=utf-8
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
vary: Accept-Encoding
access-control-allow-origin: *
cache-control: public, max-age=31919000
content-encoding: br
etag: W/"ec3bb52a00e176a7181d454dffaea219"
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-cachedat: 03/18/2024 12:13:26
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1077
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 94fb955e902e0451746ae5658fd43dd1
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8793dab549fab512-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

104.18.10.207

200 OK

31 kB

URL GET HTTP/2
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.18.10.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/OWAOutlook.html
Certificate
IssuerGoogle Trust Services LLC
Subjectbootstrapcdn.com
Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63
ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT

File type
ASCII text, with very long lines (30837)
Size
31 kB (31000 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev
DNT: 1
Connection: keep-alive
Referer: https://pub-9b0c4b61dcdb4349b13b6e0f0902a227.r2.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 24 Apr 2024 05:57:10 GMT
content-type: text/css; charset=utf-8
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
vary: Accept-Encoding
access-control-allow-origin: *
cache-control: public, max-age=31919000
content-encoding: br
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 03/18/2024 12:28:12
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1078
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 59bbeca53e643e36a5887c22ced46cbc
cdn-cache: HIT
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 8793dab559fdb512-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (6)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash