&gt; Let’s explore.

Infrastructure & activity

172.217.21.164United States AS15169 GOOGLE

Hosts: 9
Requests: 27
Received: 1.57 MB
Sent: 17.8 KB

Notable observed hosts

Report tags

www.gwenet.org

11 Jan 2026 · 06:00 UTC

7 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 7

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 599.0 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

www.gwenet.org

27 Dec 2025 · 07:56 UTC

8 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 8

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 652.8 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

www.gwenet.org

12 Dec 2025 · 16:33 UTC

8 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 8

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 610.4 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

https://r3ybta2.gfiwpu3459btgoeiprubnvoey458r.workers.dev/?username=3mail@slurpmail.net

r3ybta2.gfiwpu3459btgoeiprubnvoey458r.workers.dev

11 Dec 2025 · 15:23 UTC

3 more findings · View detections →

Detection highlights

URLQuery 3IDS 1TDS 3

Infrastructure & activity

172.67.161.240zz AS13335 CLOUDFLARENET

Hosts: 3
Requests: 11
Received: 1.39 MB
Sent: 5.9 KB

Notable observed hosts

Report tags

microsoft phishing outlook

Submit tags

http://dashboard-en.vietnamvanhien.info/?auth2=9xHFBuscxSq2RvQwhjREfhhMyl8WJlMc

dashboard-en.vietnamvanhien.info

10 Dec 2025 · 08:16 UTC

Captured page Enlarge ↗ Enter your code

Final URL Different hostname

https://ssolive.vietnamvanhien.info/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fdashboard-en.vietnamvanhien.info%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARml3_8UsF93b1zt2BuO8cV21mMnPE5mWVglasYlQkbp3-BkfEFI-MtJkH_onTPlPBit9SU1KLEksz8vAssAq9YeAyYrTg4uAQYJBgUGH6wMC5iBdoq1WiscuxaiH-rYuaOsjmCDKdY9Y3yy1JyXLXTszKyCjMr08pSnLQdQwxLc83CyowDsnNNywzyUv1c01Py8pNtjawMJ7AJTWBjOsXG8IGNsYOdYRY7wwFOxg08jAd4GX7wzf7z99fRH73vPV7x66R4uUYVuBb5h3gkZWYaGARnpVaZB6enF-b6apsUGpkHuZRn6xckFpiXuoXabhBgeABEggw_BBsaHAA1&estsfed=1&uaid=f4f1779b0b7847d789bb116d8708d43d&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=test%40test.de&login_hint=test%40test.de

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

172.67.203.196zz AS13335 CLOUDFLARENET

Hosts: 8
Requests: 33
Received: 3.65 MB
Sent: 33.1 KB

Notable observed hosts

5 more · View hosts →

Report tags

www.gwenet.org

27 Nov 2025 · 07:50 UTC

8 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 9

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 620.3 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

www.gwenet.org

27 Nov 2025 · 03:25 UTC

6 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 6

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 620.3 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

http://anythinghere.makingsoundalerts.sbs/?nflfrixe&email=domenico.passafaro@slurpmail.net

anythinghere.makingsoundalerts.sbs

21 Nov 2025 · 23:31 UTC

Captured page Enlarge ↗ MOD-336qh7kb6e

Final URL

https://anythinghere.makingsoundalerts.sbs/?qrc=domenico.passafaro%40slurpmail.net

Detection highlights

URLQuery 3IDS 0TDS 0

Infrastructure & activity

107.175.48.13United States AS36352 AS-COLOCROSSING

Hosts: 3
Requests: 19
Received: 1.73 MB
Sent: 18.5 KB

Notable observed hosts

Report tags

phishing microsoft outlook nakedpages aitm

http://lndrlab.com/Z2izNv

lndrlab.com

21 Nov 2025 · 14:48 UTC

Captured page Enlarge ↗ Budget forecasting

Final URL Different hostname

https://online-app.ruitgers.org/?auth2=GXbl2wGVyFfdiRDt2fP1Vs7sbhGqNYqm

Detection highlights

URLQuery 2IDS 0TDS 3

Infrastructure & activity

172.67.186.77zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 22
Received: 1.58 MB
Sent: 14.8 KB

Notable observed hosts

Report tags

https://online-app.testsieger-versicherungen.info/PVyTDuUR

online-app.testsieger-versicherungen.info

11 Nov 2025 · 17:46 UTC

Captured page Enlarge ↗ Blockchain ensures transparent transactions

Final URL

https://online-app.testsieger-versicherungen.info/?auth2=ylb4QGDXEnlDxFHoGPKvXyzGB_PYf5sZ

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

172.67.128.233zz AS13335 CLOUDFLARENET

Hosts: 4
Requests: 25
Received: 1.77 MB
Sent: 20.7 KB

Notable observed hosts

Report tags

http://login.haascrnc.com/las-vegas-f1-raffle?user_id=FhBsj88ldozar8v5

login.haascrnc.com

10 Nov 2025 · 22:59 UTC

https://login.haascrnc.com/?auth=2

Final URL

Detection highlights

URLQuery 3IDS 0TDS 1

Infrastructure & activity

167.172.200.50United States AS14061 DIGITALOCEAN-ASN

Hosts: 3
Requests: 13
Received: 1.42 MB
Sent: 7.3 KB

Notable observed hosts

Report tags

microsoft phishing outlook

https://emove.feversani.ar/?&login_hint=comptabilite%40ohtemiscouata.com&prompt=login&sso_reload=true

emove.feversani.ar

10 Nov 2025 · 19:20 UTC

Detection highlights

URLQuery 3IDS 0TDS 1

Infrastructure & activity

216.198.79.193United States AS16509 AMAZON-02

Hosts: 3
Requests: 10
Received: 1.30 MB
Sent: 5.0 KB

Notable observed hosts

Report tags

microsoft phishing outlook

http://base-studio.kingdairy.net/j-client/#dGVzdEBnbWFpbC5jb20=

base-studio.kingdairy.net

04 Nov 2025 · 14:29 UTC

Captured page Enlarge ↗ Get a code to sign in

Final URL Different hostname

https://ssolive.edeis.net/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fonline-app.edeis.net%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQ0zEun5ms9dFz-8c4q1znHy2cxcsbnZJaBVa5iVCZsnP4FRsYXjIy3mAT9i9I9U8KL3VJTUosSSzLz8y6wCLxi4TFgtuLg4BJgkGBQYPjBwriIFWhrwd6QN7u1lBzmzhJRmP8xnOEUq35irk9lSHhSVq5HlVdxqZN_SpVliGWZeXCRflluao53hV9gmEl2oleaj7GnrZmV4QQ2oQlsTKfYGD6wMXawM8xiZzjAybiBh_EAL8MPviOv1k978bXtvccrfh0L42RPd4tiR6MUx7LIHKOoUuc8F5eyvKAQy1Ank6TIzICk4ACLEMsg_9Ji2w0CDA-ASJDhh2BDgwMA0&estsfed=1&uaid=957537282a6f41e1a7f1dcaa459cc777&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=test%40gmail.com&login_hint=test%40gmail.com

Detection highlights

URLQuery 2IDS 1TDS 2

Infrastructure & activity

68.183.28.2United States AS14061 DIGITALOCEAN-ASN

Hosts: 5
Requests: 31
Received: 1.96 MB
Sent: 24.5 KB

Notable observed hosts

Report tags

http://studio.cssmatels.com/gsl

studio.cssmatels.com

04 Nov 2025 · 10:36 UTC

Captured page Enlarge ↗ Elastic computing adapts to demand fluctuations

Final URL Different hostname

https://ice-app.mektor.eu/?auth2=VbQ9hfeTqEdk4cwYI24-SWwaXIC78EXP

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.24.30zz AS13335 CLOUDFLARENET

Hosts: 4
Requests: 20
Received: 1.61 MB
Sent: 13.6 KB

Notable observed hosts

Report tags

http://online-app.techstroy.info/osiPzRps

online-app.techstroy.info

03 Nov 2025 · 16:41 UTC

Captured page Enlarge ↗ Get a code to sign in

Final URL Different hostname

https://ssolive.techstroy.info/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fonline-app.techstroy.info%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuASW1TzwSJV_57p2VrRPfVD691mMnPE5mWVglasYlQkbp3-BkfEFI-MtJkH_onTPlPBit9SU1KLEksz8vAssAq9YeAyYrTg4uAQYJBgUGH6wMC5iBdqatfhL-BaelU6T-Mzt1ifsZDjFqp9q4GQS4esXUVge6ZofaRyWVGZRVZjumJbm4lWZbFmZ4maSFVwYWOyWnRNpa2llOIFNaAIb0yk2hg9sjB3sDLPYGQ5wMm7gYTzAy_CD78itKX9_32t77_GKX8dTP988LdQyyCXUM9Mtw9U4u9zbIyu7pCzbPDUv3MskKyOpwsjPzMLXpSjfdoMAwwMgEmT4IdjQ4AAA0&estsfed=1&uaid=48e07ca61f6545eead9a5b4c7f5267f7&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=fuckyou%40ass.com&login_hint=fuckyou%40ass.com

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.1.84zz AS13335 CLOUDFLARENET

Hosts: 9
Requests: 49
Received: 4.80 MB
Sent: 45.7 KB

Notable observed hosts

Report tags

http://online-app.techstroy.info/osiPzRps

online-app.techstroy.info

03 Nov 2025 · 16:40 UTC

Captured page Enlarge ↗ Kubernetes orchestrates container deployment

Final URL

https://online-app.techstroy.info/?auth2=4BQ8zDLBPDnfNTZlw-Izu3zw3j7i1JNi

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.1.84zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 36
Received: 2.83 MB
Sent: 28.8 KB

Notable observed hosts

Report tags

https://online-app.girotel.info/kSeCFrtC

online-app.girotel.info

31 Oct 2025 · 22:22 UTC

Captured page Enlarge ↗ Data governance maintains information integrity

Final URL

https://online-app.girotel.info/?auth2=Usi7JcL6a1NZc_XHnNCWj-GQzPo0ttPE

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.16.155zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 32
Received: 2.80 MB
Sent: 24.8 KB

Notable observed hosts

Report tags

http://processing.nrx-immobilien.info/service

processing.nrx-immobilien.info

31 Oct 2025 · 16:55 UTC

Captured page Enlarge ↗ Mobile first

Final URL Different hostname

https://online-app.girotel.info/?auth2=F0mKrIv9g9LsLWj7kC_kwKg6MHYIdMiZ

Detection highlights

URLQuery 2IDS 1TDS 0

Infrastructure & activity

104.21.49.96zz AS13335 CLOUDFLARENET

Hosts: 9
Requests: 46
Received: 3.57 MB
Sent: 33.6 KB

Notable observed hosts

Report tags

https://processing.nrx-immobilien.info/service

processing.nrx-immobilien.info

31 Oct 2025 · 14:13 UTC

Captured page Enlarge ↗ Social media

Final URL Different hostname

https://online-app.girotel.info/?auth2=ZVtmY5RIeKFwMu2rW6JJVGCvSJHy7QVv

Detection highlights

URLQuery 2IDS 1TDS 0

Infrastructure & activity

104.21.49.96zz AS13335 CLOUDFLARENET

Hosts: 9
Requests: 46
Received: 3.56 MB
Sent: 33.7 KB

Notable observed hosts

Report tags

www.gwenet.org

28 Oct 2025 · 01:03 UTC

7 more findings · View detections →

Detection highlights

URLQuery 2IDS 2TDS 7

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 797.9 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

http://online-app.hosinsul.info/mIqNJhpM

online-app.hosinsul.info

27 Oct 2025 · 09:46 UTC

Captured page Enlarge ↗ Load balancing distributes traffic efficiently

Final URL

https://online-app.hosinsul.info/?auth2=E8VN8fuG0Rif7jmhmxJRvaW79rBZZT7w

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.46.22zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 36
Received: 2.83 MB
Sent: 29.7 KB

Notable observed hosts

Report tags