{"report_id":"f599a4a3-c614-4319-9f4d-c73dd1b0859a","version":6,"status":"done","tags":["microsoft","phishing"],"date":"2026-03-31T14:31:43Z","url":{"schema":"https","addr":"conebeauty.com.au/castleflies/purifc/homeWEBAPP.html","fqdn":"conebeauty.com.au","domain":"conebeauty.com.au","tld":"com.au"},"ip":{"addr":"103.254.137.145","port":0,"asn":55803,"as":"Hostopia Australia Web Pty Ltd","country":"Australia","country_code":"AU"},"final":{"url":{"schema":"https","addr":"conebeauty.com.au/castleflies/purifc/homeWEBAPP.html","fqdn":"conebeauty.com.au","domain":"conebeauty.com.au","tld":"com.au"},"title":"Outlook","dom":{"size":41692,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (27248)","md5":"e70e3875c11de8e34ab7231970194f75","sha1":"aa0a8614ecfbe76b81c18028243e60a34b8dd00a","sha256":"daad876090cc2fd76e92ed5959c2176f369640894e58f21e8b611a1f5f341a3a","sha512":"2ddd3d0dcc06ccfe63efe52904ccb793198db3e313a83d4875efee7c2193bf6299708a82ad582e172501c43a8ee93c574004549246e7807cfe7e86f76100542f","ssdeep":"768:7+wsTarftH1kZBbadc08FH2VJWe/KidEqyn:7+XTarB+Z5adl8FuWeaqC","tlshash":"7a137c309b902b7680715b1af15c3f012f3664a717067205b28d3fda0fa9df62f5a2e8","dom_hash":"domhashf375a46fdd4fb4ee56ad851930a3370a","first_seen":"2026-03-31T14:31:45.150334Z","last_seen":"2026-03-31T14:31:45.150334Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"conebeauty.com.au/castleflies/purifc/homeWEBAPP.html","fqdn":"conebeauty.com.au","domain":"conebeauty.com.au","tld":"com.au"},"ip":{"addr":"103.254.137.145","port":0,"asn":55803,"as":"Hostopia Australia Web Pty Ltd","country":"Australia","country_code":"AU"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-05T14:31:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-31","alert":"Phishing Block","trigger":"conebeauty.com.au","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"conebeauty.com.au","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"conebeauty.com.au","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"conebeauty.com.au","ip":{"addr":"103.254.137.145","port":443,"asn":55803,"as":"Hostopia Australia Web Pty Ltd","country":"Australia","country_code":"AU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-11-11T17:47:58.64899Z","last_seen":"2026-03-30T10:00:45.081565Z","alert_count":4,"request_count":1,"received_data":41946,"sent_data":520,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"conebeauty.com.au/castleflies/purifc/homeWEBAPP.html","fqdn":"conebeauty.com.au","domain":"conebeauty.com.au","tld":"com.au"},"ip":{"addr":"103.254.137.145","port":443,"asn":55803,"as":"Hostopia Australia Web Pty Ltd","country":"Australia","country_code":"AU"},"introduction_type":"scriptElement","is_inline":true,"md5":"33d265db3eafeb7601ce9d8f1edbb464","sha1":"55843db3e601c6ad0ca954188433f1093c6364e7","sha256":"189f40a9dfdf22ebf5604dbb8a8c83ff77ce1406986bcbfcd3bd376fca3adce2","sha512":"02c0f2a8e033eb139b445abdf2873c162df3aeff0b2c1efcba9c2b33eff17fdf1654323e848305e16bb2263c97472d564d197ce3ee89b37c62300153055ef377","ssdeep":"","tlshash":"6f41feafb9a304b14937b0be9b5f9748363480173906cc257a3c9b9c1f50d26b565aca","size":2355,"data":"","first_seen":"2026-03-31T14:31:45.153031Z","last_seen":"2026-03-31T14:31:45.153031Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"conebeauty.com.au/castleflies/purifc/homeWEBAPP.html","fqdn":"conebeauty.com.au","domain":"conebeauty.com.au","tld":"com.au"},"ip":{"addr":"103.254.137.145","port":443,"asn":55803,"as":"Hostopia Australia Web Pty Ltd","country":"Australia","country_code":"AU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-31T14:31:21.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"conebeauty.com.au","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Wed, 18 Feb 2026 00:00:00 GMT","end":"Sun, 21 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"80:B8:44:14:87:40:32:B1:B1:FE:04:14:2C:1C:57:F9:CD:8B:64:24","sha256":"49:42:8F:41:BC:09:A4:91:D1:48:13:AD:9E:FA:28:7D:43:AE:86:C8:AF:E8:2F:3D:8F:2C:74:21:E2:D4:BA:5C"}}},"request":{"raw":"GET /castleflies/purifc/homeWEBAPP.html HTTP/1.1\r\nHost: conebeauty.com.au\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Mon, 30 Mar 2026 16:31:39 GMT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: text/html\r\ndate: Tue, 31 Mar 2026 14:31:22 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":41716,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (27250)","md5":"899f5e458cbf73179bbc403f8e8c4389","sha1":"3c9f4cf67bfb0827f959becb3ce68077408eaa3b","sha256":"fecd232d4e48d1b45aa88905579ebca013b5d916c91aa85eada556b011551efb","sha512":"86cd0980cd21b5201b0c94db9dd714833c6f8292c220fefe8e76672565d4f417e274f9e85c94a89f4b4873b9b4d68c4bbb9c667f2c08aab611dcb3238b98b7bc","ssdeep":"768:R+w/TarftH1kZBbadc08FH2VJWe/KidEDyV:R+MTarB+Z5adl8FuWeaDQ","tlshash":"48137d309b902b7680715b1af15c3f012e3664a757067205b28d3fda0fa9df62f5a2e8","first_seen":"2026-03-31T14:31:45.15187Z","last_seen":"2026-03-31T14:31:45.15187Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3194,"timings":{"blocked":1425,"dns":480,"connect":355,"send":0,"wait":340,"receive":0,"ssl":592},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-03-31","alert":"Phishing Block","trigger":"conebeauty.com.au","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"conebeauty.com.au","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-31","alert":"Sinkholed","trigger":"conebeauty.com.au","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}