Submitted URL: https://microsoft-planner.notif-group.com/ly9yd825piap3hcm
Effective URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Submission: On September 24 via manual from IN — Scanned from FI

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 26 HTTP transactions. The main IP is 95.216.138.31, located in Helsinki, Finland and belongs to HETZNER-AS, DE. The main domain is access.cloudserver781.com.
TLS certificate: Issued by R10 on September 15th 2024. Valid for: 3 months.
This is the only time access.cloudserver781.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 33 95.216.138.31 24940 (HETZNER-AS)
26 1
Apex Domain
Subdomains
Transfer
31 cloudserver781.com
access.cloudserver781.com
2 MB
2 notif-group.com
microsoft-planner.notif-group.com
667 B
26 2
Domain Requested by
31 access.cloudserver781.com 7 redirects access.cloudserver781.com
microsoft-planner.notif-group.com
2 microsoft-planner.notif-group.com
26 2

This site contains links to these domains. Also see Links.

Domain
echonet.bnpparibas
Subject Issuer Validity Valid
microsoft-planner.notif-group.com
R11
2024-09-18 -
2024-12-17
3 months crt.sh
access.cloudserver781.com
R10
2024-09-15 -
2024-12-14
3 months crt.sh

This page contains 1 frames:

Primary Page: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Frame ID: AFB44ED679CD40FB29ADC906594C3B1D
Requests: 26 HTTP requests in this frame

Screenshot

Page Title

This was a phishing simulation!

Page URL History Show full URLs

  1. https://microsoft-planner.notif-group.com/ly9yd825piap3hcm Page URL
  2. http://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html HTTP 307
    https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • ([\d.]+)/jquery-ui(?:\.min)?\.js
  • jquery-ui.*\.js

Page Statistics

26
Requests

73 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

2208 kB
Transfer

2258 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://microsoft-planner.notif-group.com/ly9yd825piap3hcm Page URL
  2. http://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html HTTP 307
    https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://access.cloudserver781.com/js/events.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/events.js
Request Chain 3
  • https://access.cloudserver781.com/js/quiz.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/quiz.js
Request Chain 4
  • https://access.cloudserver781.com/js/views/campaign/bot-tracker.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/views/campaign/bot-tracker.js
Request Chain 16
  • https://access.cloudserver781.com/js/timeme.min.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/timeme.min.js
Request Chain 17
  • https://access.cloudserver781.com/js/time-tracker.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/time-tracker.js
Request Chain 19
  • https://access.cloudserver781.com/assets/modules/rating/js/awareness-rating.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=assets/modules/rating/js/awareness-rating.js
Request Chain 21
  • https://access.cloudserver781.com/js/jquery/jquery.js HTTP 302
  • https://access.cloudserver781.com/obfuscate?path=js/jquery/jquery.js

26 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
ly9yd825piap3hcm
microsoft-planner.notif-group.com/
171 B
494 B
Document
General
Full URL
https://microsoft-planner.notif-group.com/ly9yd825piap3hcm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
d2f23576669c3c71ff1f77b3c32171350d43a6b27726798d69bb8f3f995091f5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
158
content-type
text/html; charset=UTF-8
date
Tue, 24 Sep 2024 08:04:12 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Lucy
vary
Accept-Encoding,User-Agent
Primary Request index.html
access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/
Redirect Chain
  • http://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
  • https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
18 KB
5 KB
Document
General
Full URL
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
d5eb4a7da73d8433705de7d0110f8bd758ae4f8c7009d34444a901cf2d673782

Request headers

Referer
https://microsoft-planner.notif-group.com/ly9yd825piap3hcm
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
4773
content-type
text/html; charset=UTF-8
date
Tue, 24 Sep 2024 08:04:13 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Lucy
vary
Accept-Encoding,User-Agent

Redirect headers

Location
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Non-Authoritative-Reason
HttpsUpgrades
favicon.ico
microsoft-planner.notif-group.com/
198 B
173 B
Other
General
Full URL
https://microsoft-planner.notif-group.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://microsoft-planner.notif-group.com/ly9yd825piap3hcm

Response headers

cache-control
max-age=1
content-encoding
gzip
access-control-allow-methods
*
expires
Tue, 24 Sep 2024 08:04:14 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
61
date
Tue, 24 Sep 2024 08:04:13 GMT
content-type
image/vnd.microsoft.icon
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/events.js
  • https://access.cloudserver781.com/obfuscate?path=js/events.js
558 B
443 B
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/events.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
385
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:14 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/events.js
content-length
319
date
Tue, 24 Sep 2024 08:04:13 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/quiz.js
  • https://access.cloudserver781.com/obfuscate?path=js/quiz.js
2 KB
1 KB
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/quiz.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
a4cdf56198270d7d0523eebde60225f2c53c52336a1484e7a0328046ef72fb38

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
1124
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:15 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/quiz.js
content-length
317
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/views/campaign/bot-tracker.js
  • https://access.cloudserver781.com/obfuscate?path=js/views/campaign/bot-tracker.js
1 KB
803 B
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/views/campaign/bot-tracker.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
3a6a8cbb0b62b916db06a049cab318768abe60a136709861939616cef81b1f38

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
767
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:15 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/views/campaign/bot-tracker.js
content-length
339
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
bot-link.css
access.cloudserver781.com/css/
199 B
221 B
Stylesheet
General
Full URL
https://access.cloudserver781.com/css/bot-link.css
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
17c95654e88abec19b1f0acf6400fccbd68f663c6c1ae2c1453109e60f750a03

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
max-age=86400, public
content-encoding
gzip
access-control-allow-methods
*
expires
Wed, 25 Sep 2024 08:04:13 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
133
date
Tue, 24 Sep 2024 08:04:13 GMT
content-type
text/css
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*
Image2.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
20 KB
20 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/Image2.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
bac7820b4f65429376e9a45f12dbde7f69dbc66466612569c43039783c5030fa

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
20289
date
Tue, 24 Sep 2024 08:04:14 GMT
etag
"4f41-622669eaad575"
last-modified
Wed, 18 Sep 2024 15:40:04 GMT
content-type
image/png
server
Lucy
123.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
1 MB
1 MB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/123.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
ba00bb41c7c6c2fac8d8d51d4c7572a43ac1c084965764864bef8e52f6993c83

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
1443517
date
Tue, 24 Sep 2024 08:04:14 GMT
etag
"1606bd-622668cf49502"
last-modified
Wed, 18 Sep 2024 15:35:07 GMT
content-type
image/png
server
Lucy
Button_Phishing_threat_2.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
50 KB
51 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/Button_Phishing_threat_2.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
e52ba17114ead1a7b0db72e59502e5f723ef5487e3b175deb1cdbf64ab467a78

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
51484
date
Tue, 24 Sep 2024 08:04:17 GMT
etag
"c91c-622667f1dcd1d"
last-modified
Wed, 18 Sep 2024 15:31:14 GMT
content-type
image/png
server
Lucy
Banner_EN.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
104 KB
104 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/Banner_EN.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
e09e53f9b87b98ba636752489e3f77c4b2f555ca8bdb2c765f1f0a2ff9a6a16a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
106311
date
Tue, 24 Sep 2024 08:04:14 GMT
etag
"19f47-622667f1dcd1d"
last-modified
Wed, 18 Sep 2024 15:31:14 GMT
content-type
image/png
server
Lucy
phish.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
404 KB
404 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/phish.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
8d29c972dfe502c3b5d9eec3ec0f319af84b6a508ea77b5a2cb1cfa1668f5e7b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
413678
date
Tue, 24 Sep 2024 08:04:14 GMT
etag
"64fee-622667f1ddcbd"
last-modified
Wed, 18 Sep 2024 15:31:14 GMT
content-type
image/png
server
Lucy
phish_little.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
270 B
270 B
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/phish_little.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
031989df8dfd4dfd579dc8d80bba4dfa11597f0e34bb77b35c286ea4c0692e10

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

content-length
270
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
LOGO_BNPP_BL_Q.jpg
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
115 KB
116 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/LOGO_BNPP_BL_Q.jpg
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
68f1e52f9d6e1a82045f49c2587f0893ea31697b46cc223a7876ac9eef356913

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
118154
date
Tue, 24 Sep 2024 08:04:17 GMT
etag
"1cd8a-622667f1ddcbd"
last-modified
Wed, 18 Sep 2024 15:31:14 GMT
content-type
image/jpeg
server
Lucy
CIB_CyberCulture_logo.png
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
45 KB
46 KB
Image
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/CIB_CyberCulture_logo.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
5e46465549be9aa1ee4c7ea0057428146b24e022ae93cc2e7a25a376b2c2d829

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

accept-ranges
bytes
content-length
46415
date
Tue, 24 Sep 2024 08:04:17 GMT
etag
"b54f-622667f1ddcbd"
last-modified
Wed, 18 Sep 2024 15:31:14 GMT
content-type
image/png
server
Lucy
jquery-3.3.1.min.js
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
0
0
Script
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/jquery-3.3.1.min.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

content-length
270
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
jquery-ui.min.js
access.cloudserver781.com/public/campaign/1019/awareness/1189/11/
0
0
Script
General
Full URL
https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/jquery-ui.min.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

content-length
270
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/timeme.min.js
  • https://access.cloudserver781.com/obfuscate?path=js/timeme.min.js
4 KB
2 KB
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/timeme.min.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
2137
date
Tue, 24 Sep 2024 08:04:16 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:15 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/timeme.min.js
content-length
323
date
Tue, 24 Sep 2024 08:04:14 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/time-tracker.js
  • https://access.cloudserver781.com/obfuscate?path=js/time-tracker.js
2 KB
1 KB
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/time-tracker.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
48b8ecc8828ce4e364f1cc6c139841bcfdd58d51ae530aaeebccf94f856e6721

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
1025
date
Tue, 24 Sep 2024 08:04:17 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:17 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/time-tracker.js
content-length
325
date
Tue, 24 Sep 2024 08:04:16 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
fonts.css
access.cloudserver781.com/css/new-template/
715 B
260 B
Stylesheet
General
Full URL
https://access.cloudserver781.com/css/new-template/fonts.css
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
129f58b8b836cc17e45ef17e2e37d794eeb6acf28cf170fb92e1f3870a53a547

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
max-age=86400, public
content-encoding
gzip
access-control-allow-methods
*
expires
Wed, 25 Sep 2024 08:04:16 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
202
date
Tue, 24 Sep 2024 08:04:16 GMT
content-type
text/css
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/assets/modules/rating/js/awareness-rating.js
  • https://access.cloudserver781.com/obfuscate?path=assets/modules/rating/js/awareness-rating.js
3 KB
2 KB
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=assets/modules/rating/js/awareness-rating.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
73680a81b910970b437a56e912d84da8595c4683253e578d54412e8f207b4516

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
1804
date
Tue, 24 Sep 2024 08:04:17 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:17 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=assets/modules/rating/js/awareness-rating.js
content-length
351
date
Tue, 24 Sep 2024 08:04:16 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
awareness-rating.css
access.cloudserver781.com/assets/modules/rating/css/
6 KB
1 KB
Stylesheet
General
Full URL
https://access.cloudserver781.com/assets/modules/rating/css/awareness-rating.css
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
8a08ce93b27b7d6c369f4c516bddadae57c0e149981c566beac99b60c33ed7cd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
max-age=86400, public
content-encoding
gzip
access-control-allow-methods
*
expires
Wed, 25 Sep 2024 08:04:17 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
1421
date
Tue, 24 Sep 2024 08:04:17 GMT
content-type
text/css
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*
obfuscate
access.cloudserver781.com/
Redirect Chain
  • https://access.cloudserver781.com/js/jquery/jquery.js
  • https://access.cloudserver781.com/obfuscate?path=js/jquery/jquery.js
69 KB
33 KB
Script
General
Full URL
https://access.cloudserver781.com/obfuscate?path=js/jquery/jquery.js
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html
Protocol
H2
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
524e0f4776c1c53cf74db581ad1a48f999ce7bc202bdad39955e752e9a500e91

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-methods
*
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*
content-length
33322
date
Tue, 24 Sep 2024 08:04:18 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*

Redirect headers

expires
Tue, 24 Sep 2024 08:04:19 GMT
cache-control
max-age=1
location
https://access.cloudserver781.com/obfuscate?path=js/jquery/jquery.js
content-length
326
date
Tue, 24 Sep 2024 08:04:18 GMT
content-type
text/html; charset=iso-8859-1
server
Lucy
favicon.ico
access.cloudserver781.com/
198 B
114 B
Other
General
Full URL
https://access.cloudserver781.com/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
9deb629637088856fe61dc868bf40a7d21ed942e4117659f3d6c3408f59b906b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

cache-control
max-age=1
content-encoding
gzip
access-control-allow-methods
*
expires
Tue, 24 Sep 2024 08:04:19 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
61
date
Tue, 24 Sep 2024 08:04:18 GMT
content-type
image/vnd.microsoft.icon
vary
Accept-Encoding,User-Agent
server
Lucy
access-control-allow-headers
*
track-time
access.cloudserver781.com/awareness/
0
229 B
Ping
General
Full URL
https://access.cloudserver781.com/awareness/track-time
Requested by
Host: microsoft-planner.notif-group.com
URL: https://microsoft-planner.notif-group.com/ly9yd825piap3hcm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://access.cloudserver781.com/awareness/v/ly9yd825piap3hcm/index.html

Response headers

access-control-max-age
86400
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS, PUT, PATCH, HEAD, *
expires
Thu, 19 Nov 1981 08:52:00 GMT
access-control-allow-origin
*, *
content-length
0
date
Tue, 24 Sep 2024 08:04:19 GMT
content-type
text/html; charset=UTF-8
vary
User-Agent
server
Lucy
access-control-allow-headers
Content-Type, *
ico-star-feedback.png
access.cloudserver781.com/images/new-template/icons/
2 KB
2 KB
Image
General
Full URL
https://access.cloudserver781.com/images/new-template/icons/ico-star-feedback.png
Requested by
Host: access.cloudserver781.com
URL: https://access.cloudserver781.com/assets/modules/rating/css/awareness-rating.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.216.138.31 Helsinki, Finland, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.31.138.216.95.clients.your-server.de
Software
Lucy /
Resource Hash
d608e2bd595848941197c13ea75121cc21a08d9095214cc90006f6538c574820

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://access.cloudserver781.com/assets/modules/rating/css/awareness-rating.css

Response headers

cache-control
max-age=2592000
access-control-allow-methods
*
expires
Thu, 24 Oct 2024 08:04:20 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
2331
date
Tue, 24 Sep 2024 08:04:20 GMT
content-type
image/png
server
Lucy
access-control-allow-headers
*

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| lucyDispatchEvent function| Request function| lucyQuizStart function| lucyQuizEnd function| lucyQuizAnswer function| lucyQuizResults function| lucySetVariable function| lucyGetVariable function| trackClick function| closeCourse function| goEnd object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runTimeTracker function| isChrome object| objAwarenessRating function| AwarenessRating function| $ function| jQuery

5 Cookies

Domain/Path Name / Value
microsoft-planner.notif-group.com/ Name: PHPSESSID
Value: er4g47jc75ubp7t3ai68stk0tg
microsoft-planner.notif-group.com/ Name: link
Value: ly9yd825piap3hcm
access.cloudserver781.com/ Name: PHPSESSID
Value: ua4f44j9ul8djpgpo6q2ilbs7m
access.cloudserver781.com/ Name: link
Value: ly9yd825piap3hcm
access.cloudserver781.com/ Name: awareness_link
Value: ly9yd825piap3hcm

3 Console Messages

Source Level URL
Text
network error URL: https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/phish_little.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/jquery-ui.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://access.cloudserver781.com/public/campaign/1019/awareness/1189/11/jquery-3.3.1.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

access.cloudserver781.com
microsoft-planner.notif-group.com
95.216.138.31
031989df8dfd4dfd579dc8d80bba4dfa11597f0e34bb77b35c286ea4c0692e10
129f58b8b836cc17e45ef17e2e37d794eeb6acf28cf170fb92e1f3870a53a547
17c95654e88abec19b1f0acf6400fccbd68f663c6c1ae2c1453109e60f750a03
1c1aff1501eb2b60d97d99b9f4cddfde783d6503a1a2f3fd7889d0ca9be45f26
1ebe19e41a80646d99691bf907f012f60c4a6f29d362ed8209a5e0964709808d
3a6a8cbb0b62b916db06a049cab318768abe60a136709861939616cef81b1f38
48b8ecc8828ce4e364f1cc6c139841bcfdd58d51ae530aaeebccf94f856e6721
524e0f4776c1c53cf74db581ad1a48f999ce7bc202bdad39955e752e9a500e91
5e46465549be9aa1ee4c7ea0057428146b24e022ae93cc2e7a25a376b2c2d829
68f1e52f9d6e1a82045f49c2587f0893ea31697b46cc223a7876ac9eef356913
73680a81b910970b437a56e912d84da8595c4683253e578d54412e8f207b4516
8a08ce93b27b7d6c369f4c516bddadae57c0e149981c566beac99b60c33ed7cd
8d29c972dfe502c3b5d9eec3ec0f319af84b6a508ea77b5a2cb1cfa1668f5e7b
9deb629637088856fe61dc868bf40a7d21ed942e4117659f3d6c3408f59b906b
a4cdf56198270d7d0523eebde60225f2c53c52336a1484e7a0328046ef72fb38
ba00bb41c7c6c2fac8d8d51d4c7572a43ac1c084965764864bef8e52f6993c83
bac7820b4f65429376e9a45f12dbde7f69dbc66466612569c43039783c5030fa
d2f23576669c3c71ff1f77b3c32171350d43a6b27726798d69bb8f3f995091f5
d5eb4a7da73d8433705de7d0110f8bd758ae4f8c7009d34444a901cf2d673782
d608e2bd595848941197c13ea75121cc21a08d9095214cc90006f6538c574820
e09e53f9b87b98ba636752489e3f77c4b2f555ca8bdb2c765f1f0a2ff9a6a16a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52ba17114ead1a7b0db72e59502e5f723ef5487e3b175deb1cdbf64ab467a78