Report - tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=carmelnewchurchschool%E3%80%82org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=

Report Overview

Submitted URL

tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=carmelnewchurchschool%E3%80%82org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=
IP

52.18.229.67

ASN

#16509 AMAZON-02
Submitted

2023-11-21T07:52:44Z

Access

public
Website Title

Sign In
Final URL

cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Tags

phishing microsoft outlook
urlquery detections

Phishing - Microsoft Outlook

Detections

urlquery

3
Network Intrusion Detection

0
Threat Detection Systems

0

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
challenges.cloudflare.com (4)	unknown	2021-10-20 07:02:03	2023-11-21 05:09:18	2195	153489	104.17.3.184
cdnjs.cloudflare.com (2)	235	2015-04-17 22:46:33	2023-11-21 05:09:35	872	57900	104.17.24.14
segy.xyz (3)	unknown	2021-05-06 22:04:40	2023-11-21 06:04:49	1563	39981	152.89.246.205
wapprod.mpsa.com (3)	unknown	2018-12-03 10:05:06	2023-07-23 02:00:11	1452	69237	81.255.178.7
cmalntl.com (2)	unknown	2023-11-17 08:24:11	2023-11-21 06:04:46	2105	32042	172.67.135.2
tap-rt-prod1-t.campaign.adobe.com (1)	902903	2017-03-27 07:09:12	2023-11-20 05:47:33	626	674	52.18.229.67
carmelnewchurchschool.org (1)	unknown	2017-07-07 12:38:03	2023-11-20 05:40:05	550	954	67.227.241.61
ajax.googleapis.com (1)	12905	2013-08-16 11:51:31	2023-11-21 07:53:21	428	32001	142.250.74.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (9)

Pretty

URL

cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP

104.17.24.14:443
ASN

#13335 CLOUDFLARENET

Introduced by

scriptElement
Inline HTML

false

Observations

First Seen2023-03-07 01:02:13

Last Seen2023-11-28 14:37:12

Times Seen154716
Hash

8fb8fee4fcc3cc86ff6c724154c49c42

b82d238d4e31fdf618bae8ac11a6c812c03dd0d4

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Pretty

URL

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP

104.17.3.184:443
ASN

#13335 CLOUDFLARENET

Introduced by

scriptElement
Inline HTML

false

Observations

First Seen2023-11-07 13:44:12

Last Seen2023-11-28 14:37:12

Times Seen46742
Hash

6142a5f5c66e2c1be52ee9506a565962

c3b39e8352efd1e0619b6dd62af8b2a917622868

51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Pretty

URL

cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
IP

172.67.135.2:443
ASN

#13335 CLOUDFLARENET

Introduced by

scriptElement
Inline HTML

true

Observations

First Seen2023-03-07 01:01:59

Last Seen2023-11-28 14:37:51

Times Seen31883626
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Transactions (17)

URL IP Response Size

tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=carmelnewchurchschool%E3%80%82org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=

52.18.229.67

URL

tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=carmelnewchurchschool%E3%80%82org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=
IP

52.18.229.67:0
ASN

#16509 AMAZON-02

Magic

ASCII text, with no line terminators

Size

17
Hash

edf537e37d4549950774190c58f93b76

4e2078632eccec8993f151be9338bbcb88ce6f58

afff9c63cfeacd26e5d4000edf576f1386d6729dca783eb45004f484a73a3514

HTTP Headers

                                        GET /r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=carmelnewchurchschool%E3%80%82org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20= HTTP/1.1
Host: tap-rt-prod1-t.campaign.adobe.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 302 Found
Content-Type: text/plain; charset=utf-8
Date: Tue, 21 Nov 2023 07:52:26 GMT
Location: https://carmelnewchurchschool。org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=
P3P: CP="CAO DSP COR CURa DEVa TAIa OUR BUS IND UNI COM NAV"
Server: Apache
Set-Cookie: AMCV_A7672BA85ECD64E10A495FF4%40AdobeOrg=MCMID%7C21249953366770974712008570249435152383; Domain=adobe.com; Path=/; Expires=Sun, 15-Dec-2024 07:52:26 GMT
nlid=9ecb88b|c1e96b3; Domain=adobe.com; Path=/
nllastdelid=c1e96b3; Domain=adobe.com; Path=/; Expires=Sun, 15-Dec-2024 07:52:26 GMT
X-Robots-Tag: noindex
Content-Length: 17
Connection: keep-alive

carmelnewchurchschool.org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=

67.227.241.61

URL

carmelnewchurchschool.org/cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20=
IP

67.227.241.61:0
ASN

#32244 LIQUIDWEB

Magic

very short file (no magic)

Size

1
Hash

eccbc87e4b5ce2fe28308fd9f2a7baf3

77de68daecd823babbb58edb1c8e14d7106e83bb

4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

                                        GET /cache/34567876547643/1536791658/cnViZW4udHJvbXBAc3RlbGxhbnRpcy5jb20= HTTP/1.1
Host: carmelnewchurchschool.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
refresh: 0;url=https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
cache-control: max-age=0
expires: Tue, 21 Nov 2023 07:52:27 GMT
vary: Accept-Encoding,User-Agent
content-encoding: br
strict-transport-security: max-age=60
content-length: 1
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 07:52:27 GMT
server: Apache
X-Firefox-Spdy: h2

ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

142.250.74.106

200 OK

31017

URL GET HTTP/2

ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP

142.250.74.106:443
ASN

#15169 GOOGLE

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerGoogle Trust Services LLC

Subjectupload.video.google.com

FingerprintCC:96:E0:52:E0:9B:EA:A9:A0:F8:88:9A:90:20:11:47:61:00:3C:42

ValidityMon, 23 Oct 2023 11:24:07 GMT - Mon, 15 Jan 2024 11:24:06 GMT

Magic

ASCII text, with very long lines (65447)

Size

31017
Hash

8fb8fee4fcc3cc86ff6c724154c49c42

b82d238d4e31fdf618bae8ac11a6c812c03dd0d4

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

                                        GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31017
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 18 Nov 2023 11:27:58 GMT
expires: Sun, 17 Nov 2024 11:27:58 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 246270
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/82975a7a8bd156aa/1700553148953/4492d80b557e003a559de7597d0f26514e83eaf0fb7f4a3c470c02a3215d8e2e/dRtF8XkOJDhEAU-

104.17.3.184

9090

URL

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/82975a7a8bd156aa/1700553148953/4492d80b557e003a559de7597d0f26514e83eaf0fb7f4a3c470c02a3215d8e2e/dRtF8XkOJDhEAU-
IP

104.17.3.184:0
ASN

#13335 CLOUDFLARENET

Magic

data

Size

9090
Hash

6b2c3389ef85bbd8e8f61bae6a6167f9

4bf2ab13684604fe4471f361b18083713290c5b5

76458a755a369f054e0cbe8528b10be499af0be8af8b8980917791f21d2d00a4

HTTP Headers

                                        GET /cdn-cgi/challenge-platform/h/g/pat/82975a7a8bd156aa/1700553148953/4492d80b557e003a559de7597d0f26514e83eaf0fb7f4a3c470c02a3215d8e2e/dRtF8XkOJDhEAU- HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iy0qa/0x4AAAAAAANQskp_jR40sjOq/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 401 Unauthorized
date: Tue, 21 Nov 2023 07:52:31 GMT
content-type: text/plain; charset=UTF-8
www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gRJLYC1V-ADpVnedZfQ8mUU6D6vD7f0o8RwwCoyFdji4AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEA2Vpu93cQGJ2LaZqutZBtBreQbl_on09bX3jUD1xgGHNU1bhZDG0Mis-M3E9MoLsj0SXQPrgtEEXCrSty2tCoCHs4hds4Th8FtYf6vr6jcGvhP-JPUCv7zhxe2WixKmBEuBMQPOEnZpPY5qGlclA0pn5z1YdkqVDVuPLDsqYDXAsntqJEXsVqxzOxbHOAWm7Unww5KwcId437A1PncomjAGLNf0sFUKCTQ0CULWIPIaOE__-uztyz5ahlObs2gAGcQwskwDCWAS3sN5mp3SCTpB4OPKwZ1DcVhhqHJrhvtP_8AgwwCgl9K4KqkgXop7P1oLjAeJ3eQhWNua7m5REZMwIDAQAB, max-age=20, PrivateToken challenge=AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIESS2AtVfgA6VZ3nWX0PJlFOg-rw-39KPEcMAqMhXY4uABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAyAcIyqXWj0XAym0z5V844rFA0WOzLVwj0uCwmVj6zC4qOH40oBiGHrMNMBnDyk95jvnBAuHeEs855e7nA4l4DPJ4jUWKZbua8BxGAzjn74A1BV81a52F1zvBPUm-VEJXPAPXQehXphSv51uR7HKtfcM5oaS33TGDSy-6xv0r84xjMuTBvwPgXGehxpi1MCGGE5yWkzKN5Zzllk7m6Nkiv6learV-Uz7tzaoPbdZkBk1bFXxm2q07jWavoBZ-JEuEJyjQ00PSTz2Zjpbct6AlR3eCS9sbmXtb5XxSs7JMsvoa8uojD7a5m2SEJIwaf8xKL6wtxkaPonUfvsLj4JoJZQIDAQAB, max-age=20
server: cloudflare
cf-ray: 82975a8a3f2456aa-OSL
alt-svc: h3=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

104.17.24.14

200 OK

27938

URL GET HTTP/3

cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP

104.17.24.14:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D

ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

Magic

ASCII text, with very long lines (65447)

Size

27938
Hash

8fb8fee4fcc3cc86ff6c724154c49c42

b82d238d4e31fdf618bae8ac11a6c812c03dd0d4

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

                                        GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Tue, 21 Nov 2023 07:52:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 27938
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-15d9d"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2077709
expires: Sun, 10 Nov 2024 07:52:33 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BPeCQ3UmM0Qmt27D0VfBVHlkrWTy%2BArEoFrz8bd5G3dwAnElOOaW%2BHDLXcD%2B5xjpyEbVT7AzsRl%2Bs7HYjl1aEzhhSiwXgjcW54W%2FpNV%2BKbjSYqfcCtMZc0XD51ztN740IZ%2F1LPnx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82975a97ef8256ba-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

segy.xyz/api/validate

152.89.246.205

204 No Content

URL OPTIONS HTTP/1.1

segy.xyz/api/validate
IP

152.89.246.205:443
ASN

#30823 combahton GmbH

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerLet's Encrypt

Subjectsegy.xyz

Fingerprint6F:DF:90:EC:AE:D6:E0:13:C7:5C:47:EA:1A:C8:4F:0D:C0:F5:86:74

ValiditySun, 05 Nov 2023 07:19:49 GMT - Sat, 03 Feb 2024 07:19:48 GMT

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        OPTIONS /api/validate HTTP/1.1
Host: segy.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://cmalntl.com/
Origin: https://cmalntl.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 204 No Content
Server: nginx/1.18.0 (Ubuntu)
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Cache-Control: no-cache, private
Date: Tue, 21 Nov 2023 07:52:35 GMT
Access-Control-Allow-Origin: *
Vary: Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST
Access-Control-Allow-Headers: content-type
Access-Control-Max-Age: 0

segy.xyz/api/validate

152.89.246.205

204 No Content

8089

URL OPTIONS HTTP/1.1

segy.xyz/api/validate
IP

152.89.246.205:443
ASN

#30823 combahton GmbH

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerLet's Encrypt

Subjectsegy.xyz

Fingerprint6F:DF:90:EC:AE:D6:E0:13:C7:5C:47:EA:1A:C8:4F:0D:C0:F5:86:74

ValiditySun, 05 Nov 2023 07:19:49 GMT - Sat, 03 Feb 2024 07:19:48 GMT

Magic

JSON data\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with very long lines (8089), with no line terminators

Size

8089
Hash

3c6b360292c4f8dd451b14f075c9b058

e0648d6d6566b4943f17acf8a7851636f45c85e5

64ce8f907f87fa06ebee09fcce30273a7d3eee02d8b5df2527c57b6ee3caa326

HTTP Headers

                                        POST /api/validate HTTP/1.1
Host: segy.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 83
Origin: https://cmalntl.com
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Date: Tue, 21 Nov 2023 07:52:37 GMT
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
Access-Control-Allow-Origin: *

cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

104.17.24.14

200 OK

27938

URL GET HTTP/3

cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP

104.17.24.14:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerCloudflare, Inc.

Subjectsni.cloudflaressl.com

Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D

ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

Magic

ASCII text, with very long lines (65447)

Size

27938
Hash

8fb8fee4fcc3cc86ff6c724154c49c42

b82d238d4e31fdf618bae8ac11a6c812c03dd0d4

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

                                        GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

                                        HTTP/3 200 OK
date: Tue, 21 Nov 2023 07:52:38 GMT
content-type: application/javascript; charset=utf-8
content-length: 27938
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-15d9d"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2077714
expires: Sun, 10 Nov 2024 07:52:38 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x7212bs49JJeETdOJ1MVfJPU4CrTHEbzaJXcTG6EDZgymGynlsUpdI1vEYmTRmHy561aFRZP1dC1yOx%2BRrE%2BR6qrcXMeROK0HhOZP1KgTQQ44CwadJM1Pz%2BHLWDP9qZ9m7BkTh8w"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82975ab5dbfa1c06-OSL
alt-svc: h3=":443"; ma=86400

wapprod.mpsa.com/adfs/portal/css/style.css

81.255.178.7

200 OK

7805

URL GET HTTP/1.1

wapprod.mpsa.com/adfs/portal/css/style.css
IP

81.255.178.7:443
ASN

#16236 Peugeot Citroen Automobile SA

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerDigiCert Inc

Subjectwapprod.mpsa.com

FingerprintDB:58:45:10:70:4E:6C:B2:08:4F:7B:C9:DE:9A:C0:BC:1C:D1:96:E7

ValidityMon, 20 Mar 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

Magic

Unicode text, UTF-8 text, with CRLF line terminators

Size

7805
Hash

92179b9c7e8e0167c3ff089b80fd4cfc

e4caea9d593b5792705c3f6662577550007d912b

5909bfb4a2c72a24404f9a2127ad32eca6455821a6d6cd78d244a6c123723f68

HTTP Headers

                                        GET /adfs/portal/css/style.css HTTP/1.1
Host: wapprod.mpsa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Length: 7805
Content-Type: text/css
Expires: Thu, 21 Dec 2023 07:52:38 GMT
ETag: 5909BFB4A2C72A24404F9A2127AD32ECA6455821A6D6CD78D244A6C123723F68
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 21 Nov 2023 07:52:37 GMT

wapprod.mpsa.com//adfs/portal/logo/logo.jpg?id=C9E02D75B55E30CEFED6D44F3E9D3438A2A3685EE8D4D62C30F79740AB98CE4D

81.255.178.7

200 OK

6390

URL GET HTTP/1.1

wapprod.mpsa.com//adfs/portal/logo/logo.jpg?id=C9E02D75B55E30CEFED6D44F3E9D3438A2A3685EE8D4D62C30F79740AB98CE4D
IP

81.255.178.7:443
ASN

#16236 Peugeot Citroen Automobile SA

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerDigiCert Inc

Subjectwapprod.mpsa.com

FingerprintDB:58:45:10:70:4E:6C:B2:08:4F:7B:C9:DE:9A:C0:BC:1C:D1:96:E7

ValidityMon, 20 Mar 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

Magic

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, software=Adobe ImageReady], baseline, precision 8, 260x65, components 3\012- data

Size

6390
Hash

1466a76fb09789c068ab9c71d2182403

6b5cb2ed0bafa1a6c395bd9452828fa70f98f253

c9e02d75b55e30cefed6d44f3e9d3438a2a3685ee8d4d62c30f79740ab98ce4d

HTTP Headers

                                        GET //adfs/portal/logo/logo.jpg?id=C9E02D75B55E30CEFED6D44F3E9D3438A2A3685EE8D4D62C30F79740AB98CE4D HTTP/1.1
Host: wapprod.mpsa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Length: 6390
Content-Type: image/jpg
Expires: Thu, 21 Dec 2023 07:52:38 GMT
ETag: C9E02D75B55E30CEFED6D44F3E9D3438A2A3685EE8D4D62C30F79740AB98CE4D
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 21 Nov 2023 07:52:37 GMT

wapprod.mpsa.com//adfs/portal/illustration/illustration.png?id=81FDA6D50F15EACE2F806C62470557E2B882FE1A219308AAB943C9B0F4D21A1D

81.255.178.7

200 OK

54244

URL GET HTTP/1.1

wapprod.mpsa.com//adfs/portal/illustration/illustration.png?id=81FDA6D50F15EACE2F806C62470557E2B882FE1A219308AAB943C9B0F4D21A1D
IP

81.255.178.7:443
ASN

#16236 Peugeot Citroen Automobile SA

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerDigiCert Inc

Subjectwapprod.mpsa.com

FingerprintDB:58:45:10:70:4E:6C:B2:08:4F:7B:C9:DE:9A:C0:BC:1C:D1:96:E7

ValidityMon, 20 Mar 2023 00:00:00 GMT - Sat, 13 Apr 2024 23:59:59 GMT

Magic

PNG image data, 1420 x 1080, 8-bit/color RGB, non-interlaced\012- data

Size

54244
Hash

3f04367e1d39a9f905473ba944804d4a

aa9822637b6b8a2cfa4fef336f11b22a8e4bbe53

81fda6d50f15eace2f806c62470557e2b882fe1a219308aab943c9b0f4d21a1d

HTTP Headers

                                        GET //adfs/portal/illustration/illustration.png?id=81FDA6D50F15EACE2F806C62470557E2B882FE1A219308AAB943C9B0F4D21A1D HTTP/1.1
Host: wapprod.mpsa.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Length: 54244
Content-Type: image/png
Expires: Thu, 21 Dec 2023 07:52:38 GMT
ETag: 81FDA6D50F15EACE2F806C62470557E2B882FE1A219308AAB943C9B0F4D21A1D
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Date: Tue, 21 Nov 2023 07:52:37 GMT

segy.xyz/cap.php

152.89.246.205

200 OK

30973

URL POST HTTP/1.1

segy.xyz/cap.php
IP

152.89.246.205:443
ASN

#30823 combahton GmbH

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerLet's Encrypt

Subjectsegy.xyz

Fingerprint6F:DF:90:EC:AE:D6:E0:13:C7:5C:47:EA:1A:C8:4F:0D:C0:F5:86:74

ValiditySun, 05 Nov 2023 07:19:49 GMT - Sat, 03 Feb 2024 07:19:48 GMT

Magic

JSON data\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (30973), with no line terminators

Size

30973
Hash

b66f5bbc46bbcff1bb76b3a8362c7de9

ce1b6a1b4079220ca451dad480c9f79aa9fa80b8

6103f0ce68cbfda93b60873c50931d776b75dabaf90b056cc96dd6883f341419

HTTP Headers

                                        POST /cap.php HTTP/1.1
Host: segy.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 647
Origin: https://cmalntl.com
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 21 Nov 2023 07:52:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Encoding: gzip

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.17.3.184

302 Found

34254

URL GET HTTP/2

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP

104.17.3.184:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerCloudflare, Inc.

Subjectchallenges.cloudflare.com

Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E

ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

Magic

Size

34254
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 302 Found
date: Tue, 21 Nov 2023 07:52:28 GMT
cache-control: max-age=300, public
vary: accept-encoding
access-control-allow-origin: *
location: /turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
server: cloudflare
cf-ray: 82975a78dc7f56a9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cmalntl.com/favicon.ico

172.67.135.2

404 Not Found

27242

URL GET HTTP/2

cmalntl.com/favicon.ico
IP

172.67.135.2:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerLet's Encrypt

Subjectcmalntl.com

Fingerprint98:57:AE:56:75:30:2F:75:F8:C1:05:20:C5:12:7A:35:E6:DB:A0:A4

ValidityFri, 17 Nov 2023 08:03:47 GMT - Thu, 15 Feb 2024 08:03:46 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (611)

Size

27242
Hash

df3d48946e8d3f5a83608308edbb4b86

47b9c40c97abf2658df96b1c06109324e15e1a00

570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: cmalntl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 404 Not Found
date: Tue, 21 Nov 2023 07:52:28 GMT
content-type: text/html
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1qPK7d6h4kJbeKuJG3NGeHfBqLSg7kf5BpLOvzz5UsU%2FH8tuQYliFcqLFM%2F3kkGGHXGR20btkmTjxpAuivGJzOw7oTNqhb0eqjT3roANlcVzTGvRFeC%2BPZzc8vHKEg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82975a7a4a4ab4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback

104.17.3.184

200 OK

34254

URL GET HTTP/2

challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback
IP

104.17.3.184:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerCloudflare, Inc.

Subjectchallenges.cloudflare.com

Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E

ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

Magic

ASCII text, with very long lines (34253)

Size

34254
Hash

6142a5f5c66e2c1be52ee9506a565962

c3b39e8352efd1e0619b6dd62af8b2a917622868

51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

HTTP Headers

                                        GET /turnstile/v0/g/9914b343/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cmalntl.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Tue, 21 Nov 2023 07:52:28 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 82975a790ca056a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iy0qa/0x4AAAAAAANQskp_jR40sjOq/auto/normal

104.17.3.184

200 OK

72883

URL GET HTTP/3

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iy0qa/0x4AAAAAAANQskp_jR40sjOq/auto/normal
IP

104.17.3.184:443
ASN

#13335 CLOUDFLARENET

Requested by

https://cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
Certificate

IssuerCloudflare, Inc.

Subjectchallenges.cloudflare.com

Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E

ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (40091)

Size

72883
Hash

66b539132037877de6eb84aafcebf1db

f07bcc9a702891d07172335fd6d8af2f376a8910

851165153bc84361a86aed352e50df4810e224548a361f4f74349772340d397c

HTTP Headers

                                        GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/iy0qa/0x4AAAAAAANQskp_jR40sjOq/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cmalntl.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/3 200 OK
date: Tue, 21 Nov 2023 07:52:28 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 82975a7a8bd156aa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com

172.67.135.2

200 OK

3561

URL User Request GET HTTP/2

cmalntl.com/online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com
IP

172.67.135.2:443
ASN

#13335 CLOUDFLARENET

Certificate

IssuerLet's Encrypt

Subjectcmalntl.com

Fingerprint98:57:AE:56:75:30:2F:75:F8:C1:05:20:C5:12:7A:35:E6:DB:A0:A4

ValidityFri, 17 Nov 2023 08:03:47 GMT - Thu, 15 Feb 2024 08:03:46 GMT

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3769), with no line terminators

Size

3561
Hash

4ef48c4cc4e7ac675fb9a2be5cd72703

15ee8d3e54d0f650bf9e2bbe4a6ac2ab70efe9de

1ab9baa77d909dea0ac92d5a2db4906a2a87dfb97fe95d2e47f19f00f4be8d9f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

                                        GET /online-microsoft_com-48736743377809387436457-microsoft_8476365435473648347765347346837493467354634576726326362456354653263726372635625327637_%D8%AD%D8%B5%20%D8%AD%D8%A8%D9%88%D8%A8%20%D8%A7%D9%84%D8%A3%D8%B1%D8%B2%20%D8%A7%D9%84%D8%AD%D8%A7%D9%85%D8%B6%D8%A9-rr%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7F%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD%D8%B1%D9%85%D8%A7%D8%B1%D8%AF%20%D8%A7%D9%84%D8%A8%D8%AD.html?s=ruben.tromp@stellantis.com HTTP/1.1
Host: cmalntl.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/2 200 OK
date: Tue, 21 Nov 2023 07:52:28 GMT
content-type: text/html
last-modified: Fri, 17 Nov 2023 10:35:44 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2FXyWYcxGa975tqQFM%2BDXi23fYBgl4xk%2BEIq632Oro2oPzyxCCOm%2Bq7Nq%2BglUOd%2F4RVZEr9%2FQHC5nEDVpO3Nd5rYO99wJGY%2FzS0QLj00OqbSah4SzRhC6EPX79aqBw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82975a74eebfb4f1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (9)

#1 JS:Script (size: 89501)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#2 JS:Script (size: 34254)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#3 JS:Script (size: 7544)

Introduced by

Inline HTML

Observations

Hash

#4 JS:Script (size: 4452)

Introduced by

Inline HTML

Observations

Hash

#5 JS:Script (size: 0)

URL

IP

ASN

Introduced by

Inline HTML

Observations

Hash

#1 JS:Eval (size: 4)

Observations

Hash

#1 JS:Write (size: 3574)

Observations

Hash

#2 JS:Write (size: 29729)

Observations

Hash

#3 JS:Write (size: 7480)

Observations

Hash

HTTP Transactions (17)

URL

IP

ASN

Magic

Size

Hash